security: add CodeQL and dependency review gates

[rodri-oliveira-dev]

Summary

Adds two missing security layers to the Dapper.FluentMap repository baseline:

• semantic C# SAST with CodeQL;
• blocking pull-request Dependency Review for vulnerable dependency changes.

A repository-level security policy is also added so vulnerability reporting and the automated security controls are explicit to contributors and consumers.

Why

Dependabot and SonarQube Cloud already provide useful dependency maintenance and quality/security signals, but they do not replace CodeQL's semantic analysis or a dedicated review of dependency deltas introduced by each pull request.

For a public NuGet library with an established consumer base, these controls reduce the risk of shipping source-level vulnerabilities or introducing vulnerable dependencies into the package/release pipeline.

CodeQL design

• runs for pull requests targeting master, pushes to master, a weekly schedule, and manual dispatch;
• uses the SDK selected by global.json;
• analyzes the preferred Dapper.FluentMap.slnx solution;
• uses advanced setup with build-mode: manual rather than an independent autobuild path;
• reuses the existing restore + Release build contract;
• uses least-privilege permissions and SHA-pinned actions.

Dependency Review design

• runs on pull requests targeting master;
• uses the SHA-pinned Dependency Review action;
• fails on vulnerabilities with high severity or above;
• does not use continue-on-error;
• remains complementary to Dependabot, NuGet auditing, SonarQube Cloud, and existing CI compatibility/package gates.

Security policy

Adds SECURITY.md with private-reporting guidance and documents CodeQL, Dependency Review, Dependabot, SonarQube Cloud, and CI as complementary controls. It explicitly records that security gates should be triaged rather than made advisory simply to keep pipelines green.

Validation

• reviewed the complete branch diff against master;
• matched CodeQL restore/build commands to the existing CI contract;
• preserved the project's master branch convention and current release automation;
• all new workflow actions are pinned by full commit SHA;
• no production code, public API, NuGet metadata, compatibility policy, or release trigger changed;
• existing workflow-schema validation will evaluate the newly added workflow files on this PR.

Closes #191

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[rodri-oliveira-dev]

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

SonarQube Cloud success

The SonarQube Cloud Quality Gate passed for this PR.

Quality Gate status: OK

Metric	Status	Actual	Threshold
new_reliability_rating	OK	1	1
new_security_rating	OK	1	1
new_maintainability_rating	OK	1	1
new_duplicated_lines_density	OK	0.0	3
new_security_hotspots_reviewed	OK	100.0	100

• Open workflow run
• Open SonarQube Cloud dashboard