Switch to CodeQL to detect prohibited function use

[ryao]

Motivation and Context

The LLVM/Clang developers pointed out that using the CPP to detect use of functions that our QA policies prohibit risks invoking undefined behavior.

Description

We remove the CPP macros from automake in favor of adding a custom CodeQL query.

How Has This Been Tested?

I have tested this in my fork of the openzfs/zfs github repository with an experimental patch that added strncpy() to the codebase:

diff --git a/module/zfs/arc.c b/module/zfs/arc.c
index 3bcffb3c7ede..75a104251336 100644
--- a/module/zfs/arc.c
+++ b/module/zfs/arc.c
@@ -4432,6 +4432,11 @@ arc_kmem_reap_soon(void)
 	kmem_cache_t		*prev_data_cache = NULL;
 
 #ifdef _KERNEL
+	char source[] = "example";
+	char destination[10];
+
+	strncpy(destination, source, sizeof(destination));
+	destination[sizeof(destination) - 1] = '\0';
 #if defined(_ILP32)
 	/*
 	 * Reclaim unused memory from all kmem caches.

The issue was detected and the appropriate message was shown in the security tab. I did not test a PR to see what would be displayed, but I assume that the message would also show there, just as it does for the stock CodeQL queries. I can push a test commit to this PR to verify that if people feel it is necessary.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Performance enhancement (non-breaking change which improves efficiency)
• Code cleanup (non-breaking change which makes code smaller or more readable)
• Breaking change (fix or feature that would cause existing functionality to change)
• Library ABI change (libzfs, libzfs_core, libnvpair, libuutil and libzfsbootenv)
• Documentation (a change to man pages or other documentation)

Checklist:

• My code follows the OpenZFS code style requirements.
• I have updated the documentation accordingly.
• I have read the contributing document.
• I have added tests to cover my changes.
• I have run the ZFS Test Suite with this change applied.
• All commit messages are properly formatted and contain Signed-off-by.