https://github.blog/changelog/2024-01-12-code-scanning-deprecation-of-codeql-action-v2/

    On December 13, 2023, we released CodeQL Action v3, which runs on
    the Node.js 20 runtime. CodeQL Action v2 will be deprecated at the
    same time as GHES 3.11, which is currently scheduled for December
    2024.

https://github.com/github/codeql-action/blob/main/CHANGELOG.md

    Note that the only difference between v2 and v3 of the CodeQL Action
    is the node version they support, with v3 running on node 20 while
    we continue to release v2 to support running on node 16.

    Analyze (c-cpp)

    Node.js 16 actions are deprecated. Please update the following
    actions to use Node.js 20: actions/checkout@v3. For more information
    see:

    https://github.blog/changelog/2023-09-22-github-actions-transitioning-from-node-16-to-node-20/.

…d CMake and meson

There does not seem to be any documentation about how the
codeql-action/autobuild step actually works, what order it tries build
systems in, what files it uses to detect the presence of a particular
build system, if it supports any configuration variables, etc.

This commit introduces a `autobuild_force_build_system` matrix
configuration variable with values `cmake` and `meson`. If running under
the `cmake` configuration, all the non-CMake build systems are removed
before invoking the codeql-action/autobuild step. If running under the
`meson` configuration, all the non-Meson build systems are removed
before invoking the codeql-action/autobuild step. This seems to be
sufficient to force codeql-action/autobuild to pick a particular build
system but of course it's super ugly.

I did not want to get rid of the codeql-action/autobuild step entirely
and manually run the builds for each build system since there appears to
be magic auto-installation functionality in the codeql-action/autobuild
step that makes sure the right packages for each build system are
installed. Also, it automatically takes care of invoking the right
setup/build commands for the build system selected.

On the CMake build, I see this in the build log:

    cpp/autobuilder: auto installed the following packages:
    cpp/autobuilder:   libc6-dev-amd64-cross
    cpp/autobuilder:   libgcc-s1-amd64-cross

On the Meson build, I see this in the build log:

    cpp/autobuilder: auto installed the following packages:
    cpp/autobuilder:   meson
    cpp/autobuilder:   libc6-dev-amd64-cross
    cpp/autobuilder:   libgcc-s1-amd64-cross
    cpp/autobuilder:   clang-tools
    cpp/autobuilder:   cscope

So doing it using this hacky way by tricking the codeql-action/autobuild
step avoids needing to maintain manual code to ensure that the right
build systems are installed.

This seems to partially match up with the documentation of the Ubuntu
22.04 GitHub actions runner image here:

https://github.com/actions/runner-images/blob/ubuntu22/20240225.1/images/ubuntu/Ubuntu2204-Readme.md

Which says that CMake is installed in the image, but omits any mention
of Meson or Ninja. It seems the codeql-action/autobuild automatically
installed meson (but not ninja), so maybe ninja actually is installed in
the image but the Readme neglects to list it.

It looks like the build environment ends up with Meson version 0.61.2
and Ninja version 1.10.1 which correspond to the versions shipped in
Ubuntu 22.04. So if a dependency on a newer version of Meson is
introduced, it would have to be manually updated (e.g. by calling `sudo
pip install meson`). However, breaking compatibility with the Meson
shipped with Ubuntu 22.04 is probably undesired, at least for now.