More CodeQL warning fixes (#752)

* Fixing spelling errors in smacc2, cl_moveit2z and cl_nav2z public APIs

* cl_http cleanup

* cl_keyboard cmakelists cleanup

* cl_moveit2z refactor

* CpMotionPlanner

* Minor refactor of cl_nav2. Move to nav2 release 1.3.11

* ci: enable ament_cppcheck and bump pyupgrade to py311+

- Re-enable ament_cppcheck in pre-commit (excluded reference library);
  add AMENT_CPPCHECK_ALLOW_SLOW_VERSIONS=1 so the hook runs under
  cppcheck 2.x on Ubuntu 24.04 instead of silently skipping
- Add same env var to ci-ros-lint.yaml job so CI actually runs cppcheck
- Bump pyupgrade rev v2.31.0→v3.15.2 and target --py311-plus (Jazzy
  ships Python 3.12; py36-plus was six years stale)
- Update CONTRIBUTING.md: require ROS source before pre-commit run -a
- Add TYPOS.md: backlog of comment/string typos for a follow-up PR

* fix: correct comment typos in smacc2 core and cl_keyboard

* fix: correct comment typos in cl_nav2z and performance tools

* style: clang-format cb_spiral_motion.cpp

* fix: translate Spanish comments and strings to English in smacc_ros_launch_client_2

* Comment translations

* ci: add CodeQL analysis and TSan+UBSan sanitizer workflows

* ci: make CodeQL and sanitizer workflows manual-trigger only

* ci: bump actions/checkout to v5 for Node.js 24 compatibility

* ci: add rosdep init and update before install

* ci: use rosdep init || true since setup-ros already initializes it

* fix: resolve CodeQL warnings in signal_detector and nav2z planners

- signal_detector.cpp: store demangled type string before calling c_str()
  to prevent dangling pointer (cpp/use-of-string-after-lifetime-ends)
- forward_local_planner, backward_local_planner: cast float velocity
  components to double before multiplication to avoid float precision
  loss before widening (cpp/integer-multiplication-cast-to-long)
- cb_spiral_motion: same float-to-double cast for linearAceleration * dt

* Some CodeQL warning fixes

* ci: filter build/ and install/ paths from CodeQL SARIF results

* Fix format string vulnerability in CpOdomTracker::logStateString

Pass stringstream content as %s argument rather than as the format string
itself to prevent UB if the log message contains % characters.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Suppress cpp/empty-block and cpp/sizeof-side-effect in CodeQL SARIF filter

Both rule IDs are false positives in this codebase: empty blocks are
intentional no-op onExit() implementations (SMACC2 pattern), and
sizeof-side-effect is triggered by macro expansions in generated code.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: brettpac

.github/workflows/codeql.yml

@@ -62,14 +62,19 @@ jobs:
         run: |
           python3 - <<'EOF'
           import json, glob
+          SUPPRESSED_RULES = {
+              'cpp/empty-block',
+              'cpp/sizeof-side-effect',
+          }
           for path in glob.glob('sarif-results/*.sarif'):
               with open(path) as f:
                   sarif = json.load(f)
               for run in sarif.get('runs', []):
                   results = run.get('results', [])
                   run['results'] = [
                       r for r in results
-                      if not any(
+                      if r.get('ruleId', '') not in SUPPRESSED_RULES
+                      and not any(
                           loc.get('physicalLocation', {})
                              .get('artifactLocation', {})
                              .get('uri', '')

smacc2_client_library/cl_nav2z/cl_nav2z/src/cl_nav2z/components/odom_tracker/cp_odom_tracker.cpp

@@ -332,9 +332,9 @@ void CpOdomTracker::logStateString(bool debug)
   }
 
   if (debug)
-    RCLCPP_DEBUG(getLogger(), ss.str().c_str());
+    RCLCPP_DEBUG(getLogger(), "%s", ss.str().c_str());
   else
-    RCLCPP_INFO(getLogger(), ss.str().c_str());
+    RCLCPP_INFO(getLogger(), "%s", ss.str().c_str());
 }
 
 void CpOdomTracker::clearPath()