fix: check CodeQL security-severity property for high/critical findings

Also checks level == error. Security findings use security-severity >= 7.0.

Author: david-waltermire

.github/workflows/build.yml

@@ -262,7 +262,8 @@ jobs:
         if [ -d "codeql-results" ]; then
           for sarif in codeql-results/*.sarif; do
             if [ -f "$sarif" ]; then
-              CODEQL_CRITICAL=$(jq -r '[.runs[0].results[] | select(.level == "error")] | length' "$sarif" 2>/dev/null || echo "0")
+              # Check for error level OR security-severity >= 7.0 (high/critical)
+              CODEQL_CRITICAL=$(jq -r '[.runs[0].results[] | select(.level == "error" or ((.properties["security-severity"] // "0") | tonumber >= 7.0))] | length' "$sarif" 2>/dev/null || echo "0")
               if [ "$CODEQL_CRITICAL" -gt 0 ]; then
                 echo "::error::CodeQL found $CODEQL_CRITICAL critical/high severity issue(s)"
                 FAILED=true