Runs SonarScanner for .NET around a full build and the tests, with
OpenCover coverage from coverlet, on pushes to main and on pull requests
from branches of this repository. Fork and Dependabot pull requests are
skipped: the C# analysis runs inside the build, so the token and the
built code cannot be kept on separate machines as in maszyna.
The scanner is pinned in .config/dotnet-tools.json for Dependabot.
