Add CodeQL static analysis workflow #298

Summary

Gap: CodeQL is still not configured; tracked as a follow-up so static analysis covers more than dependency alerts.

Context

We now have Dependabot active for npm + GitHub Actions, and npm audit on main is down to 0 after recent remediation work. Dependency scanning alone is not enough — CodeQL would add SAST coverage for the website (JS/TS) and workflow/config surfaces.

Related recent work:

• Dependabot remediation: chore(deps): resolve Dependabot / npm audit vulnerabilities in website #286 · chore(deps): resolve open Dependabot / npm audit vulnerabilities in website #285
• Remaining image-size patch: chore(deps): clear remaining npm audit highs (image-size) #295 · chore(deps): clear remaining npm audit highs from unpatched image-size #294
• Dependabot config: https://github.com/IntersectMBO/developer-experience/blob/main/.github/dependabot.yml

Proposal

1. Add a GitHub Actions CodeQL workflow under .github/workflows/ (e.g. codeql.yml).
2. Enable analysis for javascript-typescript (primary stack for website/).
3. Run on:
   • push to main
   • pull_request targeting main
   • weekly schedule (recommended default)
4. Confirm results appear under the repo Security → Code scanning tab.
5. Optionally tune query suite (security-extended / default) once baseline noise is understood.

Acceptance criteria

• CodeQL workflow merged and running green on main
• Code scanning alerts visible in GitHub Security
• Docs/notes updated if triage process should mention CodeQL alongside Dependabot (TRIAGE.md if appropriate)

Priority

Medium — closes a known maintainer security gap after dependency remediation.