Harden open-source project tooling

[luzanovdm]

Summary

• centralize local and CI dependencies in a Homebrew Brewfile
• document a practical small-project contribution workflow, licensing terms, security support, and Contributor Covenant 3.0 enforcement
• add EditorConfig, CODEOWNERS, CI concurrency, credential hardening, and changelog guidance
• add pinned CodeQL Swift analysis that generates the ignored Xcode project before building

Why

The repository already had a strong application security model and protected main, but contributor setup was duplicated across files, the conduct policy had no private reporting or enforcement process, and code scanning was not configured.

Impact

No application behavior or release artifact changes. Contributors get one reproducible setup path, and the repository gains code scanning plus tighter workflow defaults without adding governance overhead intended for larger projects.

Validation

• brew bundle check --file=Brewfile
• Scripts/test.sh
• shellcheck Scripts/*.sh
• actionlint .github/workflows/*.yml
• Scripts/package.sh
• the CodeQL workflow's exact xcodebuild build command