ci: add CodeQL workflow for static analysis

[Emelie-Dev]

Description

Implements GitHub CodeQL static analysis across the repository to automatically catch potential security vulnerabilities during development.

Fixes backlog item #95.

Key Changes

• New Workflow: Added .github/workflows/codeql.yml which triggers on push to main and pull_request targeting main.
• Languages Analyzed: Enabled matrix execution for javascript-typescript, rust, and python, effectively analyzing the core services statically.
• Automated PR Checking: Any PR introducing known security sinks (like unsafe command execution) will now be automatically surfaced via PR comments and block merging.

Motivation & Context

Currently, the repository lacks automated static application security testing (SAST). Implementing CodeQL enforces security best practices and helps detect vulnerabilities continuously within the development lifecycle.

closes #303

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[kilodesodiq-arch]

Awesome work on this! Thanks for the contribution 🚀 Merging now.