Add harden-runner to all workflows.

[simonmarty]

Description

Why is this change being made?

1. We are adding an egress blocklist to all GitHub Actions workflows. First, we need to collect egress data to establish a baseline.
2. CodeQL analysis is now built into a GitHub repo, there's no need to have a workflow definition in GH actions for it.

What is changing?

1. Audited the step-security/harden-runner changes since our last usage in our repos step-security/harden-runner@v2.16.0...v2.19.4 for changes to our use cases only (auditing and block list) with a quick skim over other components in the diff.
2. Removed the CodeQL workflow since it's superfluous.
3. Added step-security/harden-runner step to all of our workflows in audit mode to collect a baseline.

Related Links

• Issue #, if available:

---

Testing

How was this tested?

1. No testing, this is GH action workflow changes.

When testing locally, provide testing artifact(s):

---

Reviewee Checklist

Update the checklist after submitting the PR

• I have reviewed, tested and understand all changes
  If not, why:
• I have filled out the Description and Testing sections above
  If not, why:
• Build and Unit tests are passing
  If not, why:
• Unit test coverage check is passing
  If not, why:
• Integration tests pass locally
  If not, why:
• I have updated integration tests (if needed)
  If not, why: Not needed
• I have ensured no sensitive information is leaking (i.e., no logging of sensitive fields, or otherwise)
  If not, why:
• I have added explanatory comments for complex logic, new classes/methods and new tests
  If not, why: Not needed
• I have updated README/documentation (if needed)
  If not, why: Not needed
• I have clearly called out breaking changes (if any)
  If not, why: No breaking changes.

---

Reviewer Checklist

All reviewers please ensure the following are true before reviewing:

• Reviewee checklist has been accurately filled out
• Code changes align with stated purpose in description
• Test coverage adequately validates the changes

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[madsid]

LGTM!