[CI] Add CodeQL security scanning

[nanotaboada]

Problem

No static security analysis runs on the repository. Potential vulnerabilities in dependencies or source code go undetected.

Proposed Solution

Add `.github/workflows/codeql.yml` using CodeQL Advanced, analyzing the `javascript-typescript` language pack.

Suggested Approach

Use `github/codeql-action` with `languages: [javascript-typescript]`. Schedule weekly scans in addition to push/PR triggers.

Acceptance Criteria

• `.github/workflows/codeql.yml` present
• Analyzes `javascript-typescript`
• Triggers on push to `master`, pull requests, and weekly schedule