ci: add CodeQL security scanning

[smorimoto]

As the title says.

Checklist

• npm test passes
• tests are included
• documentation is changed or added
• contribution guidelines followed
  here

[codecov-io]

Codecov Report

Merging #844 (222bcdb) into main (e1716d6) will increase coverage by 0.00%.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main     #844   +/-   ##
=======================================
  Coverage   96.12%   96.12%           
=======================================
  Files          31       31           
  Lines         929      930    +1     
=======================================
+ Hits          893      894    +1     
  Misses         36       36           

Impacted Files	Coverage Δ
lib/grab-project.js	92.00% <0.00%> (+0.16%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update e1716d6...222bcdb. Read the comment docs.

[targos]

It is not clear to me what CodeQL scanning can do for CITGM.

[smorimoto]

@targos Well, it used to be known as LGTM, but now it's part of GitHub and continues to improve in open place.

[MylesBorins]

Hey all, I made a boo boo on main and had to force push. I've rebased this branch and force pushed to make sure that you don't have to do extra work because of my mistake

[smorimoto]

There is no problem at all.

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 95.63%. Comparing base (1a385ec) to head (9fa4710).
Report is 170 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #844   +/-   ##
=======================================
  Coverage   95.63%   95.63%           
=======================================
  Files          31       31           
  Lines         940      940           
=======================================
  Hits          899      899           
  Misses         41       41           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.