ci: add CodeQL advanced setup workflow

Replaces GitHub's default CodeQL setup with an explicit workflow file, so
the analysis runs as a normal Actions check on pull requests. Default
setup runs are not backed by a workflow in the repository, which means
fork PRs produce a CodeQL result that maintainers cannot approve or gate
on. Committing the workflow makes the run approvable for fork PRs and
lets "Analyze (javascript-typescript)" be marked as a required check.

Matches the repo's existing pinned action majors (actions/checkout@v6) and
uses build-mode: none, which is the correct mode for JavaScript/TypeScript
since CodeQL extracts the source without a compilation step.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Nicolas Joseph <nicolas@fiveonefour.com>

Author: 3 people

.github/workflows/codeql.yml

@@ -0,0 +1,39 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "17 4 * * 1"
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      packages: read
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [javascript-typescript]
+        build-mode: [none]
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{ matrix.language }}"