[2.4] Add CodeQL security scanning workflow

[vbonk]

What needs to be done

Create .github/workflows/codeql.yml. Push + PR + weekly. Empty language matrix (no-op until configured). All options commented. SHA-pinned.

Acceptance Criteria

• codeql.yml exists
• Empty matrix by default
• All language options documented
• init-template uncomments matching language

[vbonk]

Completed in Phase 2 PR #86.