Add explicit CodeQL workflow to prevent duplicate runs

[Copilot]

CodeQL was running twice on each push to main because GitHub's default "dynamic" workflow had redundant triggers configured.

Changes

• Add .github/workflows/codeql.yml with explicit trigger configuration
  • Triggers: push to main, PRs to main, weekly schedule (Sunday midnight UTC)
  • Languages: C# and JavaScript/TypeScript
  • Timeout: 120 minutes
  • Replaces the dynamic workflow with repository-controlled configuration

This gives explicit control over when CodeQL runs and eliminates duplicate executions.

Original prompt

It looks like this repo is getting code-ql actions run twice with each push to main branch?

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Pull request overview

This PR adds an explicit CodeQL workflow configuration to prevent duplicate scan executions on pushes to the main branch. By creating a repository-controlled workflow file, it replaces GitHub's default dynamic workflow which was causing redundant runs.

Key Changes:

• Explicit trigger configuration (push to main, PRs to main, weekly Sunday schedule)
• Support for C# and JavaScript/TypeScript language scanning
• 120-minute timeout with proper permissions for security events

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Grammatical error: "modify them (or add more) to build your code if your project, please refer to" should be "modify them (or add more) to build your code. If your project needs custom build steps, please refer to"

Suggested change

	# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
	# modify them (or add more) to build your code. If your project needs custom build steps, please refer to the EXAMPLE below for guidance.