CI: Integrate CodeQL into the pipeline

[sohrab-]

Nice-to-have. It should help pick out problems that slip thru the cracks.

We are more interested in the reports to review, rather than it failing the pipeline.

• https://codeql.github.com/
• https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/setting-up-code-scanning-for-a-repository