Add optional SonarQube Cloud scan

[stasimus]

Adds sonar, sonar_project_key and sonar_args inputs. Scans once, on the first Scala version only, since SonarQube tracks one analysis per branch. Config is passed as scanner arguments, so no per-repo sonar-project.properties is needed.

Off by default, because three prerequisites are unmet:

1. No SONAR_TOKEN organization secret exists. Enabling it before that will fail.
2. The project must already exist on SonarQube Cloud — the scanner reports, it does not create.
3. Automatic Analysis must be off for the project; it and CI scanning are mutually exclusive.

Context: the Sonar app currently creates a check suite on every commit in repos it never analyses, leaving a permanently queued check with no result (cats-helper, scache, sstream, kafka-flow). skafka and scassandra report fine with no repo config at all, so this was never a missing-file problem.