Add CodeQL workflow for security scanning

Why

The only static analysis today is Qodana (code quality, not security). For enterprise positioning we need a SAST scanner that lands findings in the GitHub Security tab. CodeQL is the GitHub-native option, free for public repos, and supports C# (the bulk of this codebase).

Scope

• Add .github/workflows/codeql.yml — checkout, init CodeQL, build, analyze.
• Languages: csharp (primary). Maybe add javascript later if the docs site moves into this repo.
• Schedule: on push to main + PRs targeting main, plus a weekly cron for advisory-database refresh.
• Ignore generated files: source/Nuke.Common/Tools/**/*.Generated.cs, build/_build/**/obj/**, build/Build.CI.*.cs (auto-generated).

Done when

• CodeQL workflow committed
• First scan completes green (or findings triaged)
• GitHub Security tab populated