Add maintained code scanning and automated dependency update workflows

[jmanico]

Follow-up to #90 (reviewed at 31588e1). This tracks work intentionally kept separate from the modernization PR.

Current state

As checked on 2026-09-11, GitHub reports CodeQL default setup as not-configured. The repository contains a build workflow but no checked-in CodeQL or Dependabot configuration.

The project would benefit from ongoing checks after the one-time dependency updates in #90.

Acceptance criteria

• Choose one maintained CodeQL setup (default or advanced) appropriate for this Maven reactor; configure PR/default-branch and scheduled analysis as appropriate, without duplicate scan jobs.
• Confirm analysis includes the intended Java modules and relevant workflow code, and document the optional Jakarta test application's coverage.
• Establish dependency/Actions update automation with sensible grouping and cadence; cover the optional test-app POM as well as the published library modules.
• Treat the deliberately pinned Felix 5.6.12 OSGi R6 test fixture as a documented compatibility fixture: do not silently upgrade it away, and review any applicable advisories rather than blanket-suppressing findings.
• Review dependency alerts by runtime/test/build scope; document ownership and a triage process without disabling meaningful security checks.
• Preserve least-privilege permissions, keep secrets away from untrusted PR execution, and validate action changes with actionlint.
• Require the normal tests and consumer-contract checks for automated update PRs; do not enable unattended merges of packaging-sensitive changes.

Reference: GitHub code-scanning setup documentation.