Codeql testing

[vchernin]

• Todo check release notes script does not complain or does not need regeneration, and remove app stream util in Flatpak job.
• comment bot, investigate proper usage of nightly link (add to repo). Make sure it works for forks: PR Commenting bot doesn't work with forked repo's creating a PR · Issue #37 · oprypin/nightly.link. Comment bot should list commit of build.
• codeql, get it working fully. Investigate use a config file to disable all queries, and then enable some specific ones. https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-a-custom-configuration-file
• Upstream workflow fix
• Test makepkg locally
• (appstream-util:810): GLib-GIO-CRITICAL **: 20:36:23.411: g_proxy_resolver_lookup: assertion 'G_IS_PROXY_RESOLVER (resolver)' failed