🔒 Add CodeQL and cargo-audit security scanning

[renardeinside]

Summary

• Add CodeQL security scanning with security-extended query suite (Rust GA, build-mode: none)
• Add cargo-audit dependency audit job against RustSec advisory DB
• Triggers: push to main, PRs to main, weekly schedule (Monday 5 AM UTC)

Closes #123

Details

Two parallel jobs with least-privilege permissions:

Job	Purpose	Runner
CodeQL Analysis	Source-code SAST — 21 queries across 16 CWEs, models 37 crates	ubuntu-latest
Dependency Audit	Supply-chain audit via rustsec/audit-check@v2.0.0	ubuntu-latest

• Pins Rust toolchain to 1.92.0 (matches rust-toolchain.toml)
• paths-ignore skips doc-only changes on push/PR (schedule always runs full)
• Concurrency group cancels superseded PR runs

Test plan

• Both jobs trigger on this PR
• CodeQL results appear in GitHub Security tab under "Code scanning"
• cargo-audit reports advisory status for all transitive dependencies
• Scheduled scan fires on Monday 5 AM UTC

🤖 Generated with Claude Code