Optimize CodeQL workflow

[thrr87]

Summary

• add an Advanced Setup workflow for CodeQL
• run CodeQL on source, tests, build files, resources, scripts, and workflow changes
• keep a weekly scan and allow manual runs
• use an explicit arm64 Swift build instead of the heuristic autobuilder
• stop runs after 30 minutes
• pin all third-party actions to immutable commits

Why

CodeQL Default Setup runs a full Swift autobuild for every pull request, including documentation-only changes. Recent Swift scans in this repository took about 14–22 minutes, while the normal test job finished in under a minute.

After the cutover, README, documentation, image, and license-only changes will not start CodeQL. Code and workflow changes will still be scanned, and the weekly scan remains in place.

The repository is public, so standard GitHub-hosted runners are currently free. This change reduces wasted runner time and pull request latency rather than fixing a current bill.

Checks

• parsed .github/workflows/codeql.yml as YAML
• git diff --check
• ran the manual Swift build through full Xcode: swift build --arch arm64
• switched the repository from Default Setup to Advanced Setup
• verified Analyze (actions) in 33 seconds
• verified Analyze (swift) in 12 minutes 56 seconds
• verified the existing Swift test job in 49 seconds