Remove branch filter for PR event in CodeQL workflow

[mbg]

This brings the CodeQL workflow in line with other PR checks. The CodeQL workflow is required by the branch protection rule for main, but may not trigger if a PR originally targeted a non-main branch and the target branch subsequently changes (e.g. because the targeted branch was merged into main).

Risk assessment

For internal use only. Please select the risk level of this change:

• Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Which use cases does this change impact?

Environments:

• Testing/None - This change does not impact any CodeQL workflows in production.

How did/will you validate this change?

CI

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

• Rollback - Change can only be disabled by rolling back the release or releasing a new version with a fix.

How will you know if something goes wrong after this change is released?

N/A

Are there any special considerations for merging or releasing this change?

• No special considerations - This change can be merged at any time.

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Consider adding a changelog entry for this change.
• Confirm the readme and docs have been updated if necessary.

[Copilot]

Pull request overview

This PR removes the branch filter from the pull_request trigger in the CodeQL workflow to align it with other PR checks and ensure the workflow runs on all pull requests regardless of the target branch.

Key changes:

• Removes branches: [main, releases/v*] restriction from the pull_request trigger in the CodeQL workflow