Fix Android/native CodeQL on main

[ciallothu]

Summary

• disable CodeQL C/C++ TRAP caching explicitly for the Android NDK audit
• avoid the default-branch finalization failure caused by a missing tarballs cache directory
• keep Java/Kotlin and native manual-build analysis enabled

Validation

• actionlint .github/workflows/security.yml
• git diff --check
• full PR Actions and CodeQL audit required before merge