ci: gate CodeQL analysis at the job level for docs-only PRs

[rusackas]

SUMMARY

CodeQL gated only its final Perform CodeQL Analysis step on the
change-detector. On a docs-only PR that meant both language runners
(python, javascript) still spun up, checked out, ran the detector, and ran
Initialize CodeQL before skipping the actual analysis.

This moves the gate to the job level using the shared lead-changes-job
pattern (same as #40718 / #40723), so the analysis runners don't start at all
when no code changed:

  analyze:
    needs: changes
    if: needs.changes.outputs.python == 'true' || needs.changes.outputs.frontend == 'true'

Why job-level skip instead of paths-ignore: a skipped required check is
treated as passing by branch protection, whereas a paths-ignored workflow
never reports its check at all — which would deadlock merges if CodeQL is a
required check. push and scheduled (nightly) runs are unaffected: the detector
returns "all changed" for non-PR events, so full security coverage is preserved.

TESTING INSTRUCTIONS

• Code PR: confirm Analyze (python) / Analyze (javascript) run as before.
• Docs-only PR: confirm both are skipped (no CodeQL runners spin up).
• Confirm the nightly schedule and push-to-master still run the full analysis.

ADDITIONAL INFORMATION

• Has associated issue:
• Changes UI
• Includes DB Migration
• Introduces new feature or API
• Removes existing feature or API

🤖 Generated with Claude Code

[bito-code-review]

Bito Automatic Review Skipped - Files Excluded

Bito didn't auto-review this change because all changed files are in the exclusion list for automatic reviews. No action is needed if you didn't intend for the agent to review it. Otherwise, to manually trigger a review, type /review in a comment and save.
You can change the excluded files settings here, or contact your Bito workspace admin at evan@preset.io.

[bito-code-review]

The action actions/checkout in .github/workflows/codeql-analysis.yml is pinned to a commit hash (de0fac2e4500dabe0009e67214ff5f5447ce83dd), but it lacks a comment specifying the corresponding version tag (e.g., v4.2.2). To improve maintainability and security, it is recommended to add a comment indicating the version associated with that commit hash.

.github/workflows/codeql-analysis.yml

- name: Checkout
  uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2
  with:
    persist-credentials: false