fix(ci): restore CodeQL coverage of the data-drain test route

Review round 1.

- Drop the '**/test/**' and '**/tests/**' globs. A `test` directory is a
  routable Next.js path segment, and those globs excluded
  apps/sim/app/api/organizations/[id]/data-drains/[drainId]/test/route.ts —
  a POST handler that authorizes, decrypts destination credentials and makes
  an outbound request. CodeQL paths-ignore has no `!` negation to carve it
  back out, and the globs only covered 76 of 12,716 files.
- Add `ready_for_review` to the pull_request activity types. It is not a
  default type, so a PR opened as a draft and later marked ready was skipped
  by the draft guard and never rescanned until the next push.

Author: waleedlatif1

.github/codeql/codeql-config.yml

@@ -16,10 +16,16 @@ paths-ignore:
   - '**/__tests__/**'
   - '**/__mocks__/**'
   - '**/__fixtures__/**'
-  - '**/test/**'
-  - '**/tests/**'
-  - '**/testing/**'
   - '**/e2e/**'
+  # Deliberately no '**/test/**' or '**/tests/**'. A directory named `test` is a
+  # routable Next.js path segment, not necessarily test code: those globs
+  # excluded the real endpoint
+  # apps/sim/app/api/organizations/[id]/data-drains/[drainId]/test/route.ts,
+  # which authorizes, decrypts destination credentials, and makes an outbound
+  # request. CodeQL's paths-ignore has no `!` negation to carve it back out
+  # ("The filter pattern characters ?, +, [, ], and ! are not supported and will
+  # be matched literally"), and the globs only covered 76 of 12,716 files, so
+  # the naming convention above is the safer filter.
   - '**/*.d.ts'
   - '**/node_modules/**'
   - '**/dist/**'

.github/workflows/codeql.yml

@@ -22,8 +22,11 @@ on:
     branches: [main]
   pull_request:
     branches: [main, staging]
-    # Draft PRs are excluded via the job-level `if`, not here: `types` would
-    # also have to re-list the default event types to keep synchronize working.
+    # `ready_for_review` is not a default activity type, so it has to be listed
+    # alongside the defaults it replaces. Without it, a PR opened as a draft and
+    # then marked ready is skipped by the job-level draft guard and never
+    # rescanned until the next push.
+    types: [opened, synchronize, reopened, ready_for_review]
     paths:
       - '**/*.ts'
       - '**/*.tsx'