Exclude dependencies from wolfTrust Coverity scans

[aidangarske]

• Prevent submodule findings from entering wolfTrust's Coverity results.
• Remove dependency and external source units before upload.
• Reject submodules outside the configured dependency exclusion.
• Reject empty, malformed, or improperly filtered captures.
• Keep weekly scans and require HTTP 201 for upload acceptance.
• Validate filtering with the real Coverity SDK and negative fixtures.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Security-analysis coverage depends partly on external Coverity configuration and SDK behavior that requires final human verification.

Review effort: Balanced
Findings: None

What changed in this PR

Restricts Coverity uploads to wolfTrust-owned translation units and changes scans to weekly or manual execution.

Changes:

• Adds capture filtering and validation.
• Separates capture, filtering, and HTTP-validated upload.
• Documents dependency exclusions and scan scheduling.

File	Description
tools/​ci-coverity-filter.py	Removes dependency and external translation units.
.github/​workflows/​coverity.yml	Filters captures before weekly/manual uploads.
.github/​workflows/​README.md	Documents Coverity scope and configuration.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.