chore: add CodeQL SAST workflow

[nir-test-ac]

✏️ Changes

This pull request adds a security hardening workflow from the unified-pipeline-template (https://github.com/atko-cic/unified-pipeline-template/security). No functional changes are introduced.

CodeQL SAST

This PR adds .github/workflows/codeql.yml from the unified-pipeline-template. It calls github/codeql-action/init and github/codeql-action/analyze directly (SHA-pinned to v4.37.0) — no composite action wrapper, no cross-org dependency.

⚠️ Before merging, review the added .github/workflows/codeql.yml and make the changes described below, plus any other adjustments your CI environment requires.

Placeholders to fill in before merging

Placeholder	Description
javascript-typescript / java-kotlin	Update the matrix.include language entries to match this repo's actual languages. Supported values: c-cpp, csharp, go, java-kotlin, javascript-typescript, python, ruby, swift
build-mode: none	For compiled languages that fail with none or autobuild, change to manual and replace the Run manual build step with your real build command (e.g. make release, mvn package, go build ./...)

🔮 Type of Change

• Standard

🔗 References

https://auth0team.atlassian.net/browse/SEPIO-1674

• I added at least one link (task, slack thread, etc) to explain why this change is needed.

📖 Documentation

No user-facing changes have been introduced.

• I reflected this change in the (internal and/or user-facing) documentation, or added an explanation for why no documentation update is needed.

🎯 Testing

This change adds a CI workflow only; validated by the workflow running on this PR.

• This change has integration, unit, or performance test coverage, or I explained why not.

🚀 Deployment

• This change can support multiple releases of the code serving traffic at the same time.

🔥 Rollback

Reverting this PR removes the added workflow file — no further action required.

• I explained what the rollback for this change will look like.