ci(security): add CodeQL static analysis workflow

[harmeetsingh11]

Related issue

Closes #110

Summary

This PR introduces a dedicated GitHub CodeQL workflow to perform automated static security analysis for the JavaScript codebase.

The workflow complements the existing CI pipeline by continuously scanning the repository for security vulnerabilities, code quality issues, and common coding mistakes without affecting the application's runtime behavior.

Changes

• Added .github/workflows/codeql.yml

• Configured CodeQL to analyze the JavaScript codebase

• Enabled execution on:

  • push
  • pull_request
  • weekly scheduled scans

• Included dependency installation and project build steps before analysis (where applicable)

• Configured CodeQL to upload SARIF results to GitHub Security for review

Why

While the current CI validates build and functional correctness, it does not perform static security analysis.

Integrating CodeQL helps identify potential vulnerabilities such as unsafe coding patterns, injection risks, insecure API usage, and other maintainability concerns early in the development lifecycle. Running these checks automatically on every contribution improves confidence in incoming changes and strengthens the repository's overall security posture.

Impact

• Adds an automated security scanning layer to CI
• Surfaces findings directly within GitHub Security
• Requires minimal ongoing maintenance
• Does not introduce any runtime or application logic changes
• Remains isolated to GitHub Actions configuration

Verification

• Workflow syntax validated
• Workflow is configured for the JavaScript language
• Triggers verified for push, pull_request, and scheduled execution
• Existing project functionality remains unchanged

Manual Verification

• Verified workflow YAML syntax and configuration
• Confirmed CodeQL matrix configuration for JavaScript
• Verified workflow triggers for push, pull_request, and scheduled execution
• Confirmed SARIF upload step is configured for GitHub Code Scanning

Checklist

• My code follows the style guidelines of this project.
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have made corresponding changes to the documentation.
• My changes generate no new warnings or console errors.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[harmeetsingh11]

@Bindu2020324 Thanks for merging the PR. Since this contribution introduced a new CI security workflow, integrated CodeQL-based SAST, and incorporated additional workflow hardening (immutable action pinning, least-privilege checkout configuration, and CI security improvements) based on review feedback, I believe it aligns more closely with a Medium or Hard difficulty classification rather than Easy. I'd appreciate it if you could reconsider the difficulty label.