ci(security): add CodeQL scanning

[0xnavarro]

Public change

Add first-party GitHub CodeQL analysis for JavaScript/TypeScript on pull requests, pushes to main, and a weekly scheduled scan.

The workflow uses only GitHub-owned actions, pins every action to a full immutable commit SHA, persists no checkout credentials, and uses only contents: read + the minimal security-events: write. Build mode is none, so repository dependency scripts do not execute under CodeQL upload authority.

Validation

• Public repository security-only change.
• No secrets or private Brida data.
• All actions full-SHA pinned.
• Compatible with repository Actions allowlist.
• pnpm check: PASS (23/23 SDK/release tests + 8/8 policy tests).
• Workflow YAML parse: PASS.
• Full-history leak scan: PASS.
• npm pack --dry-run: PASS, 7 intended files.
• Dependency audit: no known vulnerabilities.

Compatibility / risk

No runtime/API/registry behavior changes. After the check runs successfully on this exact head, CodeQL (JavaScript/TypeScript) will be added to required main checks.

Release intent

• release-impact: none
• release-note: Add CodeQL static analysis to the public SDK security gates.
• qa-scope: CodeQL JavaScript/TypeScript analysis plus all existing required public CI checks.