ci: run required CodeQL checks on fork PRs #580

Fork pull requests such as #550, #551 and #552 pass CI but remain blocked because the main ruleset requires CodeQL checks that Default setup does not run on forks.

Add an Advanced setup CodeQL workflow on pull_request targeting main, push to main, and a weekly schedule. Preserve the actions, c-cpp, rust and javascript-typescript languages, the default query suite, and the Analyze job names required by the ruleset. Use GitHub-hosted runners, pinned actions and no build commands or secrets.

Acceptance: actionlint passes; all four analysis jobs and the CodeQL result complete successfully on a fork PR after switching off Default setup. Existing CI and branch protections remain intact.

Deployment: switch CodeQL from Default to Advanced in repository Settings before validating SARIF upload. See https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/configure-code-scanning/configuring-advanced-setup-for-code-scanning