[EngSys] Enable CodeQL for JavaScript and Actions

[mikeharder]

• Fixes [EngSys] Enable CodeQL for Actions #33023

[openapi-pipeline-app]

Next Steps to Merge

Next steps that must be taken to merge this PR:

• ❌ The required check named Protected Files has failed. Refer to the check in the PR's 'Checks' tab for details on how to fix it and consult the aka.ms/ci-fix guide

[openapi-pipeline-app]

PR validation pipeline restarted successfully. If there is ApiView generated, it will be updated in this comment.

[benbp]

What's the significance of 4:27?

[mikeharder]

This was the default when GH created the file for me. Maybe random, or the time I created the file? Can change to a more "standard" time if we want.

[benbp]

Is this supposed to be a multi line string?

[mikeharder]

config is a multi-line string. paths is a list.

https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#example-configuration

[weshaggard]

Is this to scope to only the github folder? Do we not want any other validation?

If we do want to scope it might be worth mentioning that here in a comment.