This is based on Jan-Michael's previous work, modified to use our custom
container image with scan-build as well, and to retain the eslint check.


(cherry picked from commit e86d01de69ebed244c7482266ddf122412f4cdda)