ci: fix CodeQL workflow permissions, build conditions, and trigger scope

[Copilot]

Three correctness issues in the CodeQL Advanced Setup workflow added in the previous commit.

Permissions

Added actions: read to job-level permissions — required by the actions language scanner and present in GitHub's official CodeQL starter template.

permissions:
  actions: read          # added
  contents: read
  security-events: write
  packages: read

Build configuration

• if: matrix.language == 'java-kotlin' → if: matrix.build-mode == 'manual' on both Java steps. The condition should reflect the build-mode requirement; the language-name check silently breaks if a second manually-built language is added.
• Added cache: maven to actions/setup-java to avoid re-downloading dependencies on every run.

Trigger scope

Added explicit types: [opened, synchronize, reopened] to the pull_request trigger. Without this, GitHub fires on all 13 activity types (labeled, assigned, closed, …), causing redundant scans on non-code-change events.

---

💬 Send tasks to Copilot coding agent from Slack and Teams to turn conversations into code. Copilot posts an update in your thread when it's finished.

[jcardozo-eth]

LGTM — all changes are reasonable: explicit PR event types, actions: read for visibility, generic build-mode condition, and maven caching. Squash and merge.