Introduce Github CodeQL

[skonefal]

No description provided.

[cursor]

PR Summary

Low Risk
Low risk: adds a GitHub Actions workflow for security scanning only, with no runtime or application logic changes; main impact is CI time/permissions for security-events uploads.

Overview
Adds a new GitHub Actions workflow (.github/workflows/codeql.yml) to run CodeQL Advanced scanning for the go codebase.

The workflow runs on pushes to main and on a weekly cron, checks out the repo, initializes CodeQL with autobuild, and uploads results via github/codeql-action/analyze with security-events: write permissions.

^{Reviewed by Cursor Bugbot for commit 65aa2a0. Configure here.}