ci: implement CodeQL static application security testing

[squid-protocol]

Description of Structural Changes

Visual Observatory Testing

• I tested the output JSON on GitGalaxy.io OR the Airgap Observatory.
• Flexbox constraints, HUD elements, and 3D rendering remain intact.

The Differential Scan Acknowledgement

• I understand that my PR will be subjected to a Full Differential Scan.
• I have provided the link to the specific repository this PR addresses so it can be tested alongside the 80-repo calibrated baseline.
• I believe these changes will measurably improve the engine's Accuracy, Speed, Utility, or Ethos without causing regressions.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.