ci(security): add CodeQL scanning

[0xnavarro]

Public change

Add first-party GitHub CodeQL analysis for JavaScript/TypeScript on pull requests, pushes to main, and a weekly scheduled scan.

The workflow:

• uses only GitHub-owned actions;
• pins every action to a full immutable commit SHA;
• has no write authority except the minimal security-events: write required to upload CodeQL results;
• persists no checkout credentials;
• uses build mode none, so no repository dependency scripts execute under CodeQL upload authority.

Validation

• Public repository security-only change.
• No secrets or private Brida data.
• All actions are full-SHA pinned.
• Compatible with the repository Actions allowlist.
• No package/runtime/API behavior changes.

Compatibility / risk

No public API or registry contract change. Once this PR produces the real CodeQL check successfully, that exact check can be made required on main.

Release intent

• release-impact: none
• release-note: Add CodeQL static analysis to the public repository security gates.
• qa-scope: CodeQL JavaScript/TypeScript analysis plus all existing required public CI checks.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.