[rennf93]

Code scanning now covers every language CodeQL supports in this repository, and the required code-ql check reports on every PR.

• One job named code-ql scans python,actions. It scanned only python before.
• actions scans the workflows themselves: script injection, untrusted checkouts, missing token permissions.
• The check reported as Analyze (python), so the ruleset's required code-ql check never reported.
• No more path filters: they skipped PRs that touch only workflows or docs, which left the required check missing.
• category keeps the earlier value, so the existing analyses and alerts carry over instead of going stale.

Checked: actionlint passes on the workflow. The CodeQL run on this PR is the real test.