👷 Modernize CodeQL workflow

[AnandChowdhary]

Summary

• replace the unsupported ubuntu-18.04 runner with ubuntu-latest
• update CodeQL, checkout, setup-node, and cache actions to their current Node 24-compatible majors
• add least-privilege CodeQL permissions and a manual trigger for live verification

This supersedes the narrower CodeQL v1 → v4 update in #163.

Test plan

• Parse workflow YAML and assert triggers, permissions, runner, and action refs
• actionlint passes
• Node 14.21.3 / npm 6.14.18: npm ci
• npm run build
• npm test -- --runInBand (2 suites, 2 tests)
• npm run package
• npm pack --dry-run
• git diff --check and added-line security scan

After merge, enable and dispatch CodeQL CI once to exercise the updated workflow on the default branch.