CodeQL support

[duranserkan]

Description

This introduces CodeQL, a SAST (Static Application Security Testing) tool. Unlike standard linters, it performs taint analysis over the AST (Abstract Syntax Tree) to detect security vulnerabilities with a much higher degree of confidence.

I have confirmed that this action runs correctly on my fork, so it should be safe to merge.

Running SAST scans on commits and PRs is a security best practice, so I strongly recommend integrating this and fixing the findings. I consider this change a security-related bug fix for your CI workflow.

I use this exact workflow in another repository of mine. You can safely check the run logs here to verify that the configuration is valid and effective:

https://github.com/duranserkan/DRN-Project/actions/runs/20662690492/workflow
https://github.com/duranserkan/DRN-Project/actions/runs/20662690492/job/59328518670

Corresponding issue: #3620 Enable CodeQL SAST Workflow

Testing

The workflow has been verified and functions correctly. You can check the implementation branch and the successful run logs here:

• Branch: https://github.com/duranserkan/htmx/tree/CodeQLSupport

• Run Logs: https://github.com/duranserkan/htmx/actions/runs/20876809796/job/59987410482"

Checklist

• I have read the contribution guidelines
• I have targeted this PR against the correct branch (master for website changes, dev for
  source changes)
• This is either a bugfix, a documentation update, or a new feature that has been explicitly
  approved via an issue
• I ran the test suite locally (npm run test) and verified that it succeeded

[duranserkan]

I followed the checklist and targeted dev, but because I branched from master, it looks like many unrelated commits were included. Would you prefer I rebase this onto dev, or will you squash merge it?