Add CodeQL workflow

[haru]

No description provided.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.21%. Comparing base (7de6826) to head (8f6e3f9).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop     #197   +/-   ##
========================================
  Coverage    93.21%   93.21%           
========================================
  Files           82       82           
  Lines         4244     4244           
========================================
  Hits          3956     3956           
  Misses         288      288           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Adds a GitHub Actions CodeQL workflow to run code scanning for this Redmine plugin repository on pushes/PRs to develop/main and on a weekly schedule.

Changes:

• Introduces a new .github/workflows/codeql.yml workflow.
• Runs CodeQL analysis via a language matrix (ruby, javascript-typescript, actions) using the standard init/autobuild/analyze actions.

[Copilot]

On pull_request events coming from forks, GitHub restricts GITHUB_TOKEN to read-only, so security-events: write won’t be granted and the CodeQL upload step will fail. Consider skipping this job for forked PRs (e.g., guard with an if: that only runs on same-repo PRs), or use a safer alternative workflow design for fork PRs (avoid pull_request_target + autobuild unless you fully understand the risk).