feat: add new dataflow analysis, replacing existing analysis for GitHub Actions

[nicallen]

Summary

Add a new dataflow analysis implementation, which provides a framework for sophisticated static analysis of build pipeline specifications (including GitHub Actions workflows, Bash shell scripts). Replaces the existing analysis for callgraph and build command identification.

Description of changes

Adds new dataflow analysis implementation. Removes previous callgraph representation and analysis. Updates checks to use new analysis for identification of build commands. Updates unit tests to work with the changes. Adds two new dependencies: lark (parser library used to implement parsing of GitHub expression language) and frozendict (data structure library used within dataflow analysis where hashable dicts are needed).

Related issues

Checklist

• I have reviewed the contribution guide.
• My PR title and commits follow the Conventional Commits convention.
• My commits include the "Signed-off-by" line.
• I have signed my commits following the instructions provided by GitHub. Note that we run GitHub's commit verification tool to check the commit signatures. A green verified label should appear next to all of your commits on GitHub.
• I have updated the relevant documentation, if applicable.
• I have tested my changes and verified they work as expected.
  • In addition to unit and integration tests, evaluated effect on build spec generation for 100 purls from reproducible central dataset, for the vast majority the results were unchanged, and there were no significant undesirable differences.

[behnazh-w]

You can suppress the Sphinx warnings in docs/source/conf.py:

suppress_warnings = [
    'sphinx_autodoc_typehints.forward_reference',  # Sphinx has issues with resolving forward references.
]