Proposal: Add CodeQL security analysis to CI pipeline

[shivv23]

Motivation

SeedSigner currently has no automated security analysis in CI. Recent security fixes (#897: shell injection via \os.popen(), #898: shell injection + temp file leak in \qrimage_io()) were caught during manual review. CodeQL can detect these classes of issues automatically on every commit and PR.

Proposal

Add a CodeQL workflow that runs on push/PR to dev, weekly, and via \workflow_dispatch, analyzing Python code with the default security query suite and a path-exclusion config for tests/tools/l10n.

What CodeQL catches for Python

• Command injection — relevant given fix: Replaced os.popen() with Python's inbuilt file handling #897, [Security] Fix shell injection and temp file leak in qrimage_io #898
• Path traversal — file operations in seed/settings handling
• Unsafe deserialization — data storage patterns
• Hardcoded credentials — API keys for block explorers
• Clear-text storage of sensitive data — seed/key material handling

Prior verification

• No existing open PRs for CodeQL (verified across all 73 open PRs)
• Discussion on Telegram post regarding this proposal
• Reference implementation: PR ci: add CodeQL security analysis workflow #947 (draft, linked below)

Feedback welcome.