Improve CodeQL coverage and enforce security findings before merge #305

Problem

The CodeQL workflow scans JavaScript/TypeScript with the default query suite, but does not run dedicated GitHub Actions analysis. The active rulesets inspected during the configuration review do not require CodeQL scanning or block security findings before merge. A successful analysis workflow alone does not mean there are no findings.

Proposed Solution

Implement the High- and Medium-priority recommendations from the CodeQL configuration review:

• Add actions to the CodeQL language matrix while retaining javascript-typescript and stable per-language analysis categories.
• Enable security-extended queries for both languages.
• Ensure the existing Autobuild step only runs for the JavaScript/TypeScript job, not Actions analysis.
• Document the scan coverage and administrator setup for merge enforcement.
• Have a repository administrator enable an active branch ruleset for main requiring CodeQL scan results, blocking High/Critical security alerts and error-level non-security alerts. Enable this after the updated workflow has produced both language analyses, and verify the rule blocks missing scans and qualifying alerts.

The current account has maintainer access (maintain: true, admin: false); live merge-enforcement configuration requires an administrator or an explicitly delegated rules-management role. Keep this issue open until that configuration and verification are complete.

Preserve existing triggers, pinned actions, permissions, and analysis scope. Low-priority cleanup and operational recommendations are out of scope.

Alternatives Considered

• Keep the default suite: less triage, but less security coverage.
• Use security-and-quality: broader quality findings overlap with existing TypeScript and ESLint checks; prefer security-extended initially.
• Require only successful workflow status checks: insufficient to block qualifying CodeQL findings, because a scan can succeed while reporting alerts.