[Feature]: reusable codeql workflow, verified via the testbed #57

Describe the feature

A reusable codeql workflow that runs CodeQL analysis (static analysis of the repo's own code) on pull requests, pushes to the default branch, and a schedule, with results uploaded to code scanning. Confirm it end to end via the testbed.

Depends on #56: fork PR support relies on SARIF uploads working with a fork's read-only token.

Why do you want this feature?

None of our current scanners analyze the repo's own source: govulncheck and Trivy cover known CVEs in dependencies and images, zizmor covers workflows, and scorecard covers repo practices. CodeQL today comes only from per-repo default setup, which is toggled by hand (the testbed and this repo have none), isn't versioned or reviewable, and never runs on fork PRs. That last gap blocks fork PRs in repos whose rulesets require CodeQL (OpenCHAMI/ochami#214).

Alternatives you've considered

• Enabling default setup in every repo: no code, but no fork PR coverage and no shared, versioned config.
• Per-repo CodeQL workflows, like ci: scan fork pull requests with CodeQL ochami#220: works, but duplicates the same file in every repo.

Additional context

• ci: scan fork pull requests with CodeQL ochami#220 is a good starting point: a matrix of languages (actions, go, python), a manual Go build from go.mod, pinned actions, per-job security-events: write.
• Likely inputs: languages and build mode, the Go build command, and the query suite.
• Callers must disable CodeQL default setup, which blocks advanced-setup uploads.
• Testbed: add a caller, verify all analyses upload on a PR, on main, and on a fork PR (after [Feature]: verify and fix PR workflows on fork PRs (SARIF, dependency-review comment, Coveralls) #56).

Code of Conduct

• I agree to follow this project's Code of Conduct