ci: add CodeQL analysis workflow

[omer-cengel]

Summary

Add advanced CodeQL analysis for Java source and GitHub Actions so security results are produced for pull requests, master pushes, and a weekly scheduled scan.

Changes

• Trigger analysis for pull requests targeting master and pushes to master.
• Schedule weekly analysis for Mondays at 00:00 UTC.
• Run independent actions and java-kotlin matrix analyses with distinct result categories.
• Apply scoped permissions, concurrency cancellation, hardened checkout, and CodeQL v4 initialization and analysis.
• Use the default CodeQL query suite without Java setup or a manual Maven build.

Scope and non-goals

• This change only adds the CodeQL workflow.
• It does not modify Java source, tests, Maven configuration, existing workflows, or documentation.
• It does not change repository security settings, configure query packs, or remediate CodeQL findings.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.