Add static code analysis to build

[shakuzen]

#6946 unveiled some issues that could have been caught before they were released if we had static code analysis for such issues. SpotBugs is one such option we can consider. In a quick local experiment, it did catch the issues mentioned in #6946.

[shakuzen]

See #7021. That obviates the initial reason this issue was opened. Perhaps there's still room to consider whether there are other checks that a tool like SpotBugs or something else could add that we don't have with our current build tools like ErrorProne.

[shakuzen]

Closing for now until we have more demonstrated reason to prioritize this work.