Configure SAST in `.gitlab-ci.yml`, creating this file if it does not already exist

.gitlab-ci.yml

 variables:
   CCACHE_COMPILERCHECK: content
   CCACHE_DIR: "${CI_PROJECT_DIR}/.ccache"
-
+  SAST_EXCLUDED_ANALYZERS: "bandit,semgrep"
 
 build:
   stage: build
@@ -104,3 +104,9 @@ pages:
   artifacts:
     paths:
       - public
+
+sast:
+  stage: build
+  tags: [docker]
+include:
+  - template: Security/SAST.gitlab-ci.yml  # https://gitlab.com/gitlab-org/gitlab/blob/master/lib/gitlab/ci/templates/Security/SAST.gitlab-ci.yml