CI static analysis + fixes

[bigbrett]

• Adds a CI job for PRs running cppcheck on core wolfHSM code (not on tests, bench, or examples) that fails on errors or warnings (style issues and others won't block a PR).
• Suppression for certain classes of warnings can be added to the suppression file
• source code fixes for initial round of flagged warnings

Future work

• publish artifacts so they can be downloaded for each PR and maybe for a nightly?
• add clang-tidy as a second provider

[Copilot]

Pull Request Overview

Adds a CI job to run cppcheck on core wolfHSM code (excluding tests, benchmarks, and examples) and applies source fixes to address initial warnings and errors.

• Introduces run_cppcheck.sh and a suppression list for cppcheck warnings.
• Updates C source files to correct variable initialization, refactor null checks, and simplify control flow.
• Adds a GitHub Actions workflow static-analysis.yml to invoke cppcheck and report/fail on issues.

Reviewed Changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tools/static-analysis/run_cppcheck.sh	New script to run cppcheck, generate XML/HTML/text reports, and fail on findings
tools/static-analysis/cppcheck-suppressions.txt	Suppression list for known cppcheck warnings
src/wh_transport_mem.c	Refactored volatile pointer declarations and initialization placement
src/wh_she_crypto.c	Combined nested if (ret == 0) checks into a single block for M1/M2 build and encryption
src/wh_nvm_flash.c	Moved ret declaration and null-check earlier; removed redundant if (ret == 0) in object copy
src/wh_client_she.c	Scoped in and justSent variables inside the loop only where used
src/wh_client.c	Wrapped DMA callback registration in if (rc == 0) guard
.github/workflows/static-analysis.yml	New CI workflow to install cppcheck, run static analysis, and report/fail on errors or warnings

Comments suppressed due to low confidence (1)

.github/workflows/static-analysis.yml:24

• Using continue-on-error: true on the Run cppcheck step prevents GitHub Actions from marking the job as failed, which can break the downstream 'Fail if issues found' logic. Consider removing continue-on-error and instead handling the exit code explicitly, or use a neutral outcome and check the saved exit code in later steps.

      continue-on-error: true

[billphipps]

Looks great!