CI: Add CodeQL workflow for GitHub Actions security scanning

[kevinjqliu]

This adds a CodeQL workflow to scan GitHub Actions workflow files for security issues such as script injection, use of untrusted input, and other misconfigurations.

Reference: https://github.blog/security/application-security/how-to-secure-your-github-actions-workflows-with-codeql/

Triggers:

• Push and PR to main
• Weekly scheduled scan (Mondays at 4:16 UTC)

This is based on Apache Infra recommendation,

IMPORTANT! You should enable CodeQL "actions" scanning in your repositories as described in https://github.blog/security/application-security/how-to-secure-your-github-actions-workflows-with-codeql/ - this will scan and flag those issues described below and many more automatically for you

---

This PR was generated by https://gist.github.com/kevinjqliu/97d24733c7b75cd92b68bf8f5b247891

[kosiew]

@kevinjqliu

Thanks for working on this.

[kosiew]

contents: read is declared both globally and on the job. Could this live in one place to keep the permission model easier to scan?

[kevinjqliu]

i like the approach of keeping this declare at the top-level as any future jobs added will have read permissions by default.
jobs can be explicit and specify more permissions, as shown in analyze:

[kosiew]

lgtm

[kosiew]

Merging as this a straightforward improvement PR