ci: analyse with SonarQube Cloud

Runs SonarScanner for .NET around a full build and the tests, with
OpenCover coverage from coverlet, on pushes to main and on pull requests
from branches of this repository. Fork and Dependabot pull requests are
skipped: the C# analysis runs inside the build, so the token and the
built code cannot be kept on separate machines as in maszyna.

The scanner is pinned in .config/dotnet-tools.json for Dependabot.

.config/dotnet-tools.json

@@ -0,0 +1,13 @@
+{
+  "version": 1,
+  "isRoot": true,
+  "tools": {
+    "dotnet-sonarscanner": {
+      "version": "12.1.0",
+      "commands": [
+        "dotnet-sonarscanner"
+      ],
+      "rollForward": true
+    }
+  }
+}