ci: Add automated CodeQL static analysis workflow

[AnzalKhan16]

Description

This PR introduces a new GitHub Actions workflow (codeql-analysis.yml) to automatically perform static code analysis using GitHub's native CodeQL engine.

The workflow integrates seamlessly with the existing CI pipeline and triggers automatically on all pushes and pull requests to the main branch, as well as on a weekly schedule. It utilizes a strategy matrix to initialize the CodeQL database and analyze both the javascript/typescript (frontend) and python (backend) codebases. Detected vulnerabilities and code quality issues are automatically uploaded to the repository's GitHub Security tab, providing actionable reports to help contributors fix security flaws before merging.

Related Issues

#2385

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

How Has This Been Tested?

This workflow leverages the official github/codeql-action actions (init, autobuild, and analyze). It has been configured with the necessary permissions (security-events: write) to ensure that results can be properly uploaded to GitHub. It uses standard configuration for multi-language projects and includes concurrency controls to cancel outdated runs, optimizing CI resource utilization.

Checklist

• My code follows the code style of this project.
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have made corresponding changes to the documentation.
• My changes generate no new warnings.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[utksh1]

Thank you for your interest in contributing to SecuScan.

This PR/issue is being closed for one of the following reasons:

• Duplicate functionality that already exists in the project
• Modifies critical workflows without prior maintainer discussion
• Assumes infrastructure or processes not aligned with the project

We appreciate well-thought-out contributions, but please:

1. Review existing CI/CD setup before proposing changes
2. Open an issue for discussion before submitting large PRs
3. Coordinate with maintainers on infrastructure changes

For the features we'd like to keep (Dependabot, SHA pinning, multi-arch builds, Scorecard), we'll review those PRs individually.