ci(security): add CodeQL scanning

[0xnavarro]

Public change

Add first-party GitHub CodeQL analysis for JavaScript/TypeScript on pull requests, pushes to main, and a weekly scheduled scan.

The workflow:

• uses only GitHub-owned actions;
• pins every action to a full immutable commit SHA;
• has no write authority except the minimal security-events: write required to upload CodeQL results;
• persists no checkout credentials;
• uses build mode none, so no repository dependency scripts execute under CodeQL upload authority.

Validation

• Public repository security-only change.
• No secrets or private Brida data.
• All actions are full-SHA pinned.
• Compatible with the repository Actions allowlist.
• No package/runtime/API behavior changes.

Compatibility / risk

No public API or registry contract change. Once this PR produces the real CodeQL check successfully, that exact check can be made required on main.

Release intent

• release-impact: none
• release-note: Add CodeQL static analysis to the public repository security gates.
• qa-scope: CodeQL JavaScript/TypeScript analysis plus all existing required public CI checks.

Rebased against protected main 1b2cbd05254c5449fe2297d60b047aa80271b097; exact head: 11dca663e21f11ba3350083cf07493a8746188ba. Full SDK QA, workflow parsing, tarball inspection and dependency audit pass locally on this exact head.

Supersedes #31 after rebasing onto the hardened release/security train so GitHub evaluates all pull-request checks on the exact final head.