ci: add CodeQL analysis

[saagpatel]

What

• Adds a CodeQL workflow for JavaScript/TypeScript analysis.
• Runs on PRs, pushes to main, weekly schedule, and manual dispatch.

Why

Security Review flagged this repo as missing GitHub code scanning coverage for a CodeQL-supported language surface.

How

Uses the standard CodeQL action with read-only contents permission and SARIF upload permission.

Testing

Pending GitHub PR checks.

Performance Impact

None expected for application runtime; adds CI scan time only.

Risk / Notes

Config-only security coverage change. Merge only after PR checks pass.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.