ci: Add clang-tidy and cargo clippy CI checks

[Subramanian-K812]

Add clang-tidy and cargo clippy CI checks

Adds C++ and Rust static analysis.

What this PR does

1. C++ — clang-tidy via score_cpp_policies (tools/lint/linters.bzl), wired as a
   clang_tidy_test target for test_scenarios_cpp.
2. Rust — plain cargo clippy --locked --all-targets -- -D warnings against
   test_scenarios_rust, pinned to toolchain 1.92.0.
3. Both run as new, independent jobs in build_scenarios.yml.

This bypasses the shared eclipse-score/cicd-workflows Clippy mechanism, which doesn't
actually run (0 reports on every invocation, including in persistency). The real fix is
tracked at eclipse-score/baselibs#541; once that lands, this interim setup will be dropped.

Files

• MODULE.bazel — adds score_cpp_policies, toolchains_llvm (dev deps) + registers
  the LLVM toolchain (llvm_version = 22.1.7, cxx_standard, link_libs, stdlib);
  bumps aspect_rules_lint 1.0.3 → 2.5.0 (marked dev_dependency) and
  score_bazel_cpp_toolchains 0.5.1 → 0.5.4; bumps sdp_version 8.0.0 → 8.0.4 on both
  QNX gcc toolchains
• .clang-tidy — new, local copy of the score_cpp_policies baseline check groups
• .bazelrc — new clang-tidy config
• tools/lint/linters.bzl, tools/lint/BUILD.bazel — new, the clang-tidy aspect wiring
• BUILD — exports .clang-tidy so the sandboxed lint action can see it
• score/test_scenarios_cpp/BUILD — adds the clang_tidy test target (tags = ["manual"], since the aspect always resolves the C++ toolchain on analysis
  regardless of --config, and would otherwise break the plain
  bazel build //.../bazel test //... jobs)
• .github/workflows/build_scenarios.yml — new clang-tidy and clippy jobs

Verification

• bazel build //... / bazel test //... (no config change) — unaffected, still pass
• bazel test --config=clang-tidy //score/test_scenarios_cpp:clang_tidy — passes, and
  genuinely executes clang-tidy (confirmed real diagnostics run, unlike the broken shared
  Clippy path)
• cargo clippy --locked --all-targets -- -D warnings at the pinned 1.92.0 toolchain —
  clean

Known limitations

• score/test_scenarios_cpp/tests/*.cpp isn't linted (aspect default excludes cc_test;
  same as eclipse-score/baselibs)
• buildifier_prebuilt has the same pre-existing unused-non-dev-dependency issue
  aspect_rules_lint had — left as is, out of scope here