take advantage of new code scanning feature of GitHub actions

[edwardhartnett]

See https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning

Let's give it a try...