Start enforcing SCA checks and quality gates on codebase

[rmseng]

To do:

• Enable SpotBugs' enforcing mode, choose a level to enforce at, and solve all reported issues
• Also consider adding a merge gate on SonarQube analysis