[FEATURE]: add codeQL as SAST

[haochengxia]

Integrate GitHub CodeQL into our CI pipeline for automated Static Application Security Testing (SAST)

---

Feature Category: Build system improvement

---

Use Cases:

• Early Detection: Developers get immediate security feedback.
• Prevent Merges: Stop vulnerable code from reaching main branches.
• Continuous Monitoring: Track existing and prevent new vulnerabilities.
• Compliance: Aid in audits with scan records.

---

Alternatives Considered: SonarQube, Snyk, Checkmarx. CodeQL's deep GitHub integration, cost (free for public repos), and customizability make it preferable.

---

Implementation:

• Create .github/workflows/codeql-analysis.yml.
• Configure to run on push and pull_request for relevant branches.
• Specify programming languages.
• Ensure alerts appear in GitHub Security and PR checks.
• Consider path exclusions (e.g., tests).
• Commit package-lock.json for npm command pinning.

---

Additional Context: CodeQL uses semantic analysis for accurate vulnerability detection.