engineering: adjust CodeQL checks to check more things

[tonycoz]

per subject.

I enabled codeql a long time ago, but just use the default checks, see if there's other checks I could be using.

Consider also clang-tidy checks.