Introduce Github CodeQL

[skonefal]

No description provided.

[cursor]

PR Summary

Low Risk
Low risk since it only adds a GitHub Actions workflow for scheduled/push CodeQL scanning and does not change application/runtime code.

Overview
Adds a new GitHub Actions workflow (.github/workflows/codeql.yml) to run CodeQL Advanced scanning on pushes to main and on a weekly cron.

The job runs CodeQL analysis for actions and javascript-typescript with required security-events permissions, using pinned actions/checkout and github/codeql-action versions.

^{Reviewed by Cursor Bugbot for commit 9d7f18d. Configure here.}