[Epic] Evaluate quality plugins and make recommendations

[binkley]

Choose build plugin(s) to bake "quality checks" into Gradle and Maven, and avoid configuring each tool separately.

• Spotless spike ([Spike] Try out Spotless; outcome: Do include Spotless in the project #489)
• Spotless implementation (Document Spotless #535)
• Qulice spike ([Spike] Try out Qulice; outcome, do not include Qulice in the project #490)
• Qualice implementation -- do not implement as per spike results
• CleanThat spike ([Won't implement][Spike] Try out CleanThat #491) -- separate from support in Spotless
• error_prone spike (Try out error_prone and write about it in the wiki #492) -- note: alternative Java compiler
• Qodana spike ([Spike] Try out Qodana #527) -- CI only?
• CodeQL (Talk about CodeQL from GitHub #564) -- CI only?
• SonarQube ([Spike] Try out SonarQube #580) -- CI only?
• Review security plugins (Find additional security plugins for Gradle and Maven #493)
• Update wiki pages with links to relevant cards for relevant tools

Questions to answer when evaluating a plugin:

• What is the license?
• Does the plugin work with both Gradle and Maven?
• What IDEs have add-ons for the tool?
• How does this mesh with Checkstyle? Or can the plugin replace Checkstyle?
• Can the plugin automatically reformat the code as part of the local build process?
• If code is reformatted before pushing, how will the programmer be aware of this?
• Does the plugin have good backward/forward compatibility and adaptability to different versions of the language, its dependencies and the runtime environment (jvm)?
• Is the plugin configurable in its rules to meet my team standards?
  • Book tries to be agnostic on most things. An existing example is the checkstyle settings in config/checkstyle/*.