Simplifies the CI job and adds a cache to avoid downloading the 1GB+
tool archive on every run.
See: https://github.com/vapier/coverity-scan-action
Only run this job when a commit is pushed to the default branch 2.0
(like when a PR is merged) since the required Coverity token/secret
is not available when this job is triggered by forks.
This is an initial setup with similarities to how we test
via TravisCI; build via autotools and build via cmake.
Additional testmatrix for sanitizer testing.
