Add path-filtered CodeQL workflow for content-specific analysis (#1444)

* Initial plan

* Add path-filtered CodeQL workflow for content-specific analysis

Create .github/workflows/codeql.yml that uses dorny/paths-filter to
detect which language directories changed, then only runs CodeQL
analysis for those languages. This replaces the default setup which
analyzed all languages on every PR regardless of changed files.

On push to main and scheduled runs, all languages are analyzed.
On PRs, only languages with changed files are analyzed.

Co-authored-by: edburns <75821+edburns@users.noreply.github.com>

* Add clarifying comment for if: always() in CodeQL workflow

Co-authored-by: edburns <75821+edburns@users.noreply.github.com>

* Add rust.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Fix codeql.yml: add rust, fix path filters, skip changes job on non-PRs

Co-authored-by: edburns <75821+edburns@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: edburns <75821+edburns@users.noreply.github.com>
Co-authored-by: Ed Burns <edburns@microsoft.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Author: 3 people

.github/workflows/codeql.yml

@@ -0,0 +1,102 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "0 6 * * 1" # Weekly on Monday at 06:00 UTC
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  changes:
+    name: Detect changed paths
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      java: ${{ steps.filter.outputs.java }}
+      js: ${{ steps.filter.outputs.js }}
+      python: ${{ steps.filter.outputs.python }}
+      go: ${{ steps.filter.outputs.go }}
+      rust: ${{ steps.filter.outputs.rust }}
+      csharp: ${{ steps.filter.outputs.csharp }}
+      actions: ${{ steps.filter.outputs.actions }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            java:
+              - 'java/**'
+            js:
+              - 'nodejs/**'
+              - 'scripts/**'
+              - 'test/harness/**'
+            python:
+              - 'python/**'
+            go:
+              - 'go/**'
+            rust:
+              - 'rust/**'
+            csharp:
+              - 'dotnet/**'
+            actions:
+              - '.github/workflows/**'
+              - '.github/actions/**'
+
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    needs: changes
+    # Run even if 'changes' is skipped (e.g. on push/schedule where paths-filter
+    # may not flag changes). Each step has its own gate condition.
+    if: always()
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: java-kotlin
+            gate: java
+          - language: javascript-typescript
+            gate: js
+          - language: python
+            gate: python
+          - language: go
+            gate: go
+          - language: rust
+            gate: rust
+          - language: csharp
+            gate: csharp
+          - language: actions
+            gate: actions
+    steps:
+      - name: Checkout repository
+        if: ${{ needs.changes.outputs[matrix.gate] == 'true' || github.event_name == 'schedule' || github.event_name == 'push' }}
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        if: ${{ needs.changes.outputs[matrix.gate] == 'true' || github.event_name == 'schedule' || github.event_name == 'push' }}
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        if: ${{ needs.changes.outputs[matrix.gate] == 'true' || github.event_name == 'schedule' || github.event_name == 'push' }}
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        if: ${{ needs.changes.outputs[matrix.gate] == 'true' || github.event_name == 'schedule' || github.event_name == 'push' }}
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"