Add CodeQL security scanning workflow

[PAMulligan]

Description

Add a GitHub CodeQL analysis workflow for automated security vulnerability detection in JavaScript/TypeScript code within the repository.

Why

Nerva generates production APIs — security is a core value. CodeQL provides free, deep static analysis that catches injection vulnerabilities, insecure data handling, and other security issues that linters miss. It also provides security alerts directly in the GitHub Security tab.

Acceptance Criteria

• Create .github/workflows/codeql.yml
• Configure for JavaScript/TypeScript analysis
• Run on push to main and on pull requests
• Run on a weekly schedule for catching newly discovered vulnerability patterns
• CI passes

Example

name: CodeQL
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 6 * * 1'  # Weekly Monday 6am UTC

jobs:
  analyze:
    name: Analyze
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - uses: actions/checkout@v4
      - uses: github/codeql-action/init@v3
        with:
          languages: javascript-typescript
      - uses: github/codeql-action/analyze@v3