chore(ci): enable CodeQL code scanning and upload bandit SARIF

[perezmlal]

Code scanning was in the "Needs setup" state. Add an advanced-setup CodeQL workflow rather than enabling default setup, so the analysis can cover the GitHub Actions workflows alongside the Python services and the website, run the security-extended query suite, and coexist with the existing bandit job.

bandit now emits SARIF and uploads it under its own category, so Python SAST findings become tracked alerts with dedup and dismissal history instead of a one-off red check. The upload is skipped for pull requests from forks, whose GITHUB_TOKEN is read-only; the pass/fail gate still blocks those PRs.

bandit exits 2 and writes an empty report when it cannot parse its config, so the step distinguishes findings (exit 1) from tool errors (exit >= 2) and hard -fails on the latter rather than uploading an empty report over the alerts. The toml extra keeps the pyproject.toml config parseable below Python 3.11.

Description

Type of change

• Bug fix
• New feature
• Documentation
• Refactor / chore

Checklist

• I have read the Contributing guidelines.
• Tests added or updated for the change (see the Testing Policy), or I have explained below why tests are not applicable.
• poetry run pytest passes locally.
• ruff check and bandit report no new issues (see the Development guide).
• Documentation updated where relevant (README, docs/, CHANGELOG.md).
• I am not including secrets, credentials, or sensitive data.
• Security-impacting changes have been considered; vulnerabilities are reported privately via SECURITY.md, not in this PR.

Notes for reviewers

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.