Mark sqlite as lib folder in CodeQL scan

[ShrutiJaiswal1494]

Add CodeQL.yml file to add sqlite as a library.

[ThomsonTan]

Will mark sqlite as 'library' exclude it from the scanning result?

[ShrutiJaiswal1494]

Yes, I believe so.

[ThomsonTan]

But why exclude sqlite from the result? as we forked it, we need make sure the fork is clean on CodeQL, is this right?

[lalitb]

My opinion - I like the approach of configuring SQLite as a library for CodeQL, if that removes false positives. The usage of memcpy and memset within such a widely used database should generally be safe. Adding any guarded functions to make CodeQL happy could introduce side effects that might be difficult to catch in normal tests. A more fruitful effort would be to upgrade the SQLite3 snapshot to the latest version.

But anyway better to have @ThomsonTan decide on this, he knows more on CodeQL :)

p.s -

Not related, but an interesting usage spectrum for SQLite3 - https://www.sqlite.org/mostdeployed.html

SQLite is likely used more than all other database engines combined. Billions and billions of copies 
of SQLite exist in the wild.

it is seems likely that there are over one trillion (1e12) SQLite databases in active use.

[ThomsonTan]

Based on our discussion, #1286 is preferred so close this one.