Add additional static code analysis and linting plugins to the project build

[rmseng]

e.g.:

• PMD
• Spotless / Checkstyle
• Error Prone (Google)
• NullAway (Uber)

Some of this might be a bit duplicative with what SonarQube already offers us.

Enable SpotBugs' enforcing mode, choose a level to enforce at, and solve all reported issues.
Also consider adding a merge gate on SonarQube analysis.