* Adjust version numbers and a test to conform to the SemVer spec.
Gson releases since 2.8.0 have been following this spec. We mistakenly released 2.10
without the .0 patch version, and adjusted `GsonVersionDiagnosticsTest` so it would
accept that, as well as the two-digit `10`. Here we make the test no longer accept
versions without a patch number, while still accepting two-digit minor versions of course.
We also change the snapshot version to 2.11.0-SNAPSHOT instead of 2.11-SNAPSHOT.
* Add CodeQL GitHub code scanning workflow
* Only compile main sources for code scanning
* Move test .proto files to test sources
`annotations.proto` also seems to be only relevant for tests because the test
explicitly registers them as extensions. By default the Proto adapter does not
consider them.
* Address some code scanning findings
* Fix some more findings
On some versions of Android (probably on some variants of the popular Samsung S4 phone), an older version of Gson is suspected to be bundled in, and gets picked up from the system classpath.
For those versions, the applications that include the latest Gson fail unexpectedly. This debug print will help confirm this issue.