ci: add advanced CodeQL scanning

[sirmrdrgod]

Summary

• add advanced CodeQL analysis for javascript-typescript and GitHub Actions with build-mode: none
• run the security-extended query suite with stable per-language result categories
• restrict workflow permissions to contents: read and security-events: write
• scan pushes and pull requests to main, support manual runs, and schedule a weekly Wednesday 05:47 UTC scan
• ignore only generated or vendored output under coverage/**, dist/**, and node_modules/**

Why

This adds repeatable semantic security scanning for the repository's JavaScript/JSX source and GitHub Actions workflows. No CodeQL default setup or previous code-scanning analyses were configured when checked.

Validation

• npm run test — 4 test files and 48 tests passed
• npm run build — passed
• NODE_OPTIONS=--use-system-ca npm run security:audit — found 0 vulnerabilities
• YAML parse, workflow contract, whitespace, and final-newline checks — passed

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.