[cmake] adds static analysis target

also cleans up a few duplicate/mismatch source entries