ci: add GitHub Actions to CodeQL language matrix (#542)

CodeQL now also scans the workflow files (script injection, secret
handling, etc.) alongside Python. build-mode: none already applies to
both languages. zizmor and actionlint still run separately and cover
overlapping workflow-security ground.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: turbomam

.github/workflows/codeql.yml

@@ -20,7 +20,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: ['python']
+        language: ['python', 'actions']
     steps:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3