ci: add explicit CodeQL workflow for fork PR support

[brunobuddy]

Summary

• Add .github/workflows/codeql.yml to replace GitHub's default CodeQL setup
• The default setup does not run on pull requests from forks, causing the required CodeQL status check to stay pending forever on external contributions
• The explicit workflow triggers on pull_request, push to main, and weekly schedule

Notes

• Default CodeQL setup has already been disabled via the API (state: not-configured)
• No post-merge manual steps needed

Test plan

• Verify the CodeQL check triggers on this PR and passes
• Confirm the check name matches the ruleset requirement (CodeQL)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.58%. Comparing base (353e274) to head (84f9388).
⚠️ Report is 7 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #959   +/-   ##
=======================================
  Coverage   95.58%   95.58%           
=======================================
  Files         204      204           
  Lines        8968     8968           
  Branches     2553     2553           
=======================================
  Hits         8572     8572           
  Misses        294      294           
  Partials      102      102           

Flag	Coverage Δ
backend	96.16% <ø> (ø)
frontend	95.22% <ø> (ø)
plugin	93.97% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.