Add scoped CodeQL scans for Go, Python and Actions

[kwisatzh]

Summary

Add SHA-pinned CodeQL scans for Go, Python examples and GitHub Actions, with minimal job-level permissions. Scan every PR, main pushes and weekly; compile Go with the existing fixed 1.26.9 toolchain. Retain Actions coverage when switching from default setup.

Maintainer action before enabling uploads

GitHub default CodeQL setup is currently enabled here. GitHub rejects advanced-workflow uploads while default setup is enabled. Disable only default setup in Settings > Advanced Security > CodeQL analysis, then rerun this workflow and verify all three language uploads. The workflow stays enabled. No settings were changed by this PR.

This is documented in .github/SECURITY_MAINTENANCE.md with the official migration link. No rulesets or approval requirements change. Unreleased v0.6.0 implementation is excluded.

Validation

Actionlint, permission/trigger checks and the Go 1.26.9 Linux build pass. Hosted upload requires the maintainer migration above; this PR remains draft until then.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.