Add security CI workflows

[BukeLy]

Summary

• Add an explicit CodeQL advanced setup workflow for Actions and Python analysis.
• Add a Dependency Review workflow to gate pull requests that introduce vulnerable dependencies.
• Disable CodeQL default setup so the CodeQL Action workflow can upload results without the default-setup SARIF rejection.

Source-backed timing

• CodeQL runs on pull_request, push to main, and a weekly schedule, matching GitHub's guidance that PR/push scans prevent new issues and scheduled scans catch newly discovered vulnerabilities later: https://docs.github.com/en/code-security/reference/code-scanning/workflow-configuration-options#configuring-frequency
• Dependency Review runs on pull_request, matching GitHub's documented PR dependency-diff gate: https://docs.github.com/en/code-security/concepts/supply-chain-security/about-dependency-review and https://github.com/actions/dependency-review-action#installation-standard
• CodeQL default setup was disabled before relying on this workflow because GitHub documents that default setup blocks CodeQL Action SARIF uploads: https://docs.github.com/en/code-security/reference/code-scanning/sarif-files/troubleshoot-sarif-uploads/default-setup-enabled

Validation

• Ruby YAML parser loaded all .github/workflows/*.yml successfully.
• The planned PyYAML validation command could not run locally because this environment does not have the yaml Python module installed.