ci: add CodeQL security and quality scanning

[ErikMeinders]

Summary

Enables GitHub code scanning via CodeQL, which was previously not configured on the repo (only Dependabot was active).

What it does

• Analyzes the Python source with the security-and-quality query suite
• Triggers on pushes to main/develop, PRs to main, and a weekly schedule
• Uploads results to the repo's Security → Code scanning tab

Notes

• Uses the same pinned action major versions as the existing workflows (actions/checkout@v7, github/codeql-action@v3)
• Secret scanning + push protection were also enabled on the repo settings (no code change needed for those)

🤖 Generated with Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Copilot]

Pull request overview

Adds a dedicated GitHub Actions workflow to enable CodeQL code scanning for this repository, complementing existing security automation (e.g., Dependabot and the release workflow’s audit job).

Changes:

• Introduces a CodeQL workflow that scans the Python codebase using the security-and-quality query suite.
• Configures triggers for pushes to main/develop, PRs targeting main, and a weekly scheduled run.
• Uploads CodeQL analysis results to GitHub’s Code scanning UI via security-events: write.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.