Re-enable CodeQL with configuration file to limit workflow triggers

[Copilot]

This PR re-enables CodeQL security analysis with proper configuration to prevent workflows from running on every push to any branch, which was clogging up the CI/CD pipeline.

Changes Made

CodeQL Workflow (.github/workflows/codeql.yml)

• Limited triggers: Only runs on pull requests to main and pushes to main branch
• Weekly security scans: Scheduled runs every Monday at 5:15 AM UTC for ongoing security monitoring
• Multi-language support: Analyzes both JavaScript/TypeScript and Rust code using matrix strategy
• Proper permissions: Configured with minimal required permissions for security scanning

CodeQL Configuration (.github/codeql/codeql-config.yml)

• Security-focused queries: Uses security-and-quality query suites for comprehensive analysis
• Optimized paths: Focuses analysis on src and examples directories
• Efficient exclusions: Ignores build artifacts, dependencies, and generated files to reduce noise:
  • node_modules, dist, target directories
  • Generated TypeScript/JavaScript files
  • Documentation and asset directories

Benefits

• Reduces CI load: Eliminates CodeQL runs on feature branch pushes
• Maintains security: Ensures all code reaching main is analyzed
• Comprehensive coverage: Supports both primary languages in the repository
• Performance optimized: Excludes unnecessary files from analysis

The configuration follows GitHub's best practices and uses the latest CodeQL action versions for optimal performance and security.

Fixes #3336.

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.