ci: Add code scanning CodeQL workflow

[matthewfeickert]

Description

Add code scanning from GitHub by adding a CodeQL workflow. The workflow added is a modified version of the starting stock workflow GitHub provides. Alerts are shown in the Security tab for the project.

c.f.

• GitHub Blog: Code scanning is now available!
• GitHub Docs: Enabling code scanning for a repository

Checklist Before Requesting Reviewer

• Tests are passing
• "WIP" removed from the title of the pull request
• Selected an Assignee for the PR to be responsible for the log summary

Before Merging

For the PR Assignees:

• Summarize commit messages into a comprehensive review of the PR

* Add code scanning workflow using GitHub's CodeQL
   - c.f. https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning-for-a-repository

[codecov]

Codecov Report

Merging #1085 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master    #1085   +/-   ##
=======================================
  Coverage   96.81%   96.81%           
=======================================
  Files          59       59           
  Lines        3490     3490           
  Branches      499      499           
=======================================
  Hits         3379     3379           
  Misses         68       68           
  Partials       43       43           

Flag	Coverage Δ
#unittests	96.81% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 182c643...76bb366. Read the comment docs.

[matthewfeickert]

This might make LGTM (one of the slowest checks) unnecessary now, given that CodeQL is the result of GitHub acquiring Semmle.