Introduce Github CodeQL

[skonefal]

No description provided.

[cursor]

PR Summary

Low Risk
Low risk since this only adds a GitHub Actions workflow for security scanning and does not change application runtime code; the main impact is additional CI time and potential new code-scanning alerts.

Overview
Adds a new GitHub Actions workflow (.github/workflows/codeql.yml) to run CodeQL Advanced code scanning on pushes to main and on a weekly cron.

The workflow analyzes actions (no build) and go (autobuild), uses pinned versions of actions/checkout and github/codeql-action, and uploads results via security-events: write permissions.

^{Reviewed by Cursor Bugbot for commit d0f7820. Configure here.}