Adjust CodeQL configuration

[Zeitsperre]

Pull Request Checklist:

• This PR addresses an already opened issue (for bug fixes / features)
  • This PR fixes #xyz
• Tests for the changes have been added (for bug fixes / features)
  • (If applicable) Documentation has been added / updated (for bug fixes / features)

What kind of change does this PR introduce?

• Reduces the frequency that CodeQL is run (on push and on the first of the month)
• Restrict the CodeQL workflow permissions
• Pins CodeQL actions to commit hashes for security reasons

Does this PR introduce a breaking change?

• No.

Other information: