Use scan-build-py for unified output

Scan-build produces one file per compilation unit, and GitHub doesn't
like that any more [1,2]. Scan-build-py produces a merged file, too,
so use that. Unfortunately clang-tools doesn't provide an unversioned
symlink yet, so detect the version from the scan-build one.

[1] https://github.blog/changelog/2024-05-06-code-scanning-will-stop-combining-runs-from-a-single-upload/
[2] github/codeql-action#1381

.github/workflows/analysis.yaml

@@ -32,20 +32,29 @@ jobs:
       - uses: actions/checkout@v4
       - name: 'workaround for Meson versions < 1.1'
         run: ln -s meson.options meson_options.txt
+      - name: find scan-build-py
+        run: |
+          llvm_version="$(readlink $(command -v scan-build) | cut -d '-' -f 3)"
+          SCAN_BUILD_PY="$(command -v scan-build-py-${llvm_version})"
+          test -x "${SCAN_BUILD_PY}"
+          echo "SCAN_BUILD_PY=${SCAN_BUILD_PY}" >> ${GITHUB_ENV}
       - name: meson setup
-        run: scan-build --use-cc=clang meson setup -Dpdf-doc=false build
+        run: |
+          "${SCAN_BUILD_PY}" --use-cc=clang meson setup -Dpdf-doc=false build
       - name: meson compile
-        run: scan-build --use-cc=clang -sarif -o sarif-output meson compile -C build/
-      - name: find output directory
         run: |
-          echo "SARIF_DIR=$(ls -d sarif-output/*)" >> ${GITHUB_ENV}
+          "${SCAN_BUILD_PY}" --use-cc=clang -sarif -o sarif-output meson compile -C build/
+      - name: find output file
+        id: sarif-output
+        run: |
+          echo "file=$(find sarif-output/ -name results-merged.sarif)" >> ${GITHUB_OUTPUT}
       - name: define CONTAINER_WORKSPACE
         run: |
           echo "CONTAINER_WORKSPACE=${PWD}" >> ${GITHUB_ENV}
       - name: upload SARIF results
         uses: github/codeql-action/upload-sarif@v3
         with:
-          sarif_file: ${{ env.SARIF_DIR }}
+          sarif_file: ${{ steps.sarif-output.outputs.file }}
           checkout_path: ${{ env.CONTAINER_WORKSPACE }}
 
   cppcheck: