ci: add CodeQL security scanning workflow

[thananon]

Summary

Add CodeQL static analysis workflow following ROCm project standards (amdsmi/aqlprofile pattern) to scan C/C++ code for security vulnerabilities.

Details

• Runs on develop and mainline branch pushes and PRs
• Weekly scheduled scan on Fridays at 6:34 PM UTC
• Uses security-extended query suite for comprehensive coverage
• Builds with minimal dependencies (no NIC/MPI) for faster analysis

Motivation

Part of TheRock component onboarding requirements - Security & Compliance check.

Testing

Workflow will run automatically on this PR. Expected to complete successfully with the minimal build configuration.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Copilot]

Pull request overview

Adds a GitHub Actions CodeQL workflow to run C/C++ static security analysis for TransferBench as part of TheRock onboarding Security & Compliance requirements.

Changes:

• Introduces a new .github/workflows/codeql.yml workflow for CodeQL scanning on pushes/PRs to develop and mainline, plus a weekly scheduled run.
• Configures CodeQL to use the security-extended query suite and performs a minimal CMake build (NIC/MPI disabled) to drive analysis.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[thananon]

Copilot review feedback addressed in commit 2c44bc4:

1. Interactive prompts: Added -y flag to apt-add-repository to prevent CI jobs from hanging on confirmation prompts

2. Git safe.directory permissions: Replaced wildcard '*' with ${GITHUB_WORKSPACE} for minimal necessary permissions while maintaining defense-in-depth

3. Container tag: Intentionally kept rocm/dev-ubuntu-22.04:latest unpinned per maintainer preference (see thread)

4. YAML indentation: No action needed - YAML syntax is valid and parses correctly