Add CodeQL to GitHub CI Action (fixes #2185)

[vorburger]

Fixes #2185 (hopefully, we'll see).

This is a variant of #2206, which was an alternative approach to #2204 & #2205 and the earlier #2027.

This take uses a very large VM (like #2198).

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[jingtang10]

have you seen this michael?

[jingtang10]

happy for you to merge this to iterate, but please keep the issue open until code ql actually works well.

thanks so much for investigating @vorburger!