Add security-extended to CodeQL queries

[tonybaloney]

This PR adds the security-extended queries to the CodeQL CI workflow.

These queries are more aggressive, which means that they can raise false positives, which is why they are disabled by default. But they're also really helpful and find lots of security bugs that the standard queries don't. The standard queries don't really check much in the way of security scans, they're mostly for general code quality.

[tonybaloney]

For the issues raised in this PR, https://docs.github.com/en/code-security/secure-coding/triaging-code-scanning-alerts-in-pull-requests#dismissing-an-alert-on-your-pull-request

If someone can please confirm the status of them and I can flag (or the maintainer can), using those instructions.

Issues can be dismissed in a couple of ways:

• won't fix - kept as an issue but flagged so it won't show again
• false positive - closes the issue and makes sure it isn't scanned again

As some of the issues are related to file input propagating in tooling, you can also use the "show paths" command in GitHub

[bagder]

Thanks, I went over all of the alerts and they were all false positives. Primarily in these two categories:

1. using a file name passed in as an argument via argv[]
2. using a weak cipher algorithm in NTLM code

[bagder]

Thanks!