Enable `security-and-quality` CodeQL queries

[hiddeco]

To improve the usefulness of the CodeQL scans, we should enable the more advanced security-and-quality queries on our repositories.

For an example, see: https://github.com/hiddeco/sshsig/blob/main/.github/workflows/codeql.yaml#L34-L36

To-do

• pkg
• source-controller
• kustomize-controller
• helm-controller
• notification-controller
• image-automation-controller
• image-reflector-controller
• flux2
• <potentially others>

[hiddeco]

I see this is also being used in https://github.com/fluxcd/go-git-providers/blob/main/.github/workflows/scan.yaml#L23-L26