feat(security): stage CodeQL default-setup config pending upstream provider

[JacobPEvans-personal]

Summary

Adds code_scanning.tf as a commented-out placeholder for the eventual github_repository_code_scanning_default_setup resource, plus a one-line update to the README's "Next up" section pointing at it.

The repo stays pure declarative HCL — no scripts, no null_resource, no third-party stopgap providers. When upstream ships, uncomment + bump version + apply.

Why staged commented

integrations/terraform-provider-github does not yet expose a resource for PUT /repos/{owner}/{repo}/code-scanning/default-setup. Verified against the provider source — the security_and_analysis block in github_repository has advanced_security, code_security (paid GHAS), secret_scanning, secret_scanning_push_protection, secret_scanning_ai_detection, and secret_scanning_non_provider_patterns — but no field for free CodeQL default-setup.

Upstream PR: integrations/terraform-provider-github#3315 — opened 2026-04-01 by oda251, still open. Adds the resource with this schema:

Field	Type	Required	Notes
repository	string	yes
state	string	yes	configured or not-configured
query_suite	string	no	default or extended
languages	set(string)	optional/computed	auto-detected from repo content

The commented block in this PR uses that exact shape so the merge-time delta is just removing # prefixes.

Cost impact

$0 (once enabled). Code scanning is FREE on public repos — no GHAS license consumed. The data.github_repositories query stages with visibility:public as the safety belt; no private repo can land in the for_each. Belt-and-suspenders: org-default GHAS is off per AGENTS.md "Cost policy", so an accidental PUT against a private repo would 403 anyway.

What lands when upstream ships

1. Bump version in versions.tf to the integrations/github release including #3315
2. Remove leading `# ` from the data + resource blocks in code_scanning.tf
3. tofu apply

Test plan

• Pre-commit hooks pass locally (terraform_fmt, terraform_validate, tflint, checkov, tofu test) — verified before push.
• CI gate green on PR — verify the "Detect Changes" + "Terraform" + "Merge Gate" checks come back green.
• Inspect comment-block schema against upstream PR #3315 once more before merging.
• After upstream ships: bump provider version, uncomment, tofu plan to confirm the expected creates (one resource per public repo with a supported language).

🤖 Generated with Claude Code