fix(ci): CodeQL use 'actions' extractor, not javascript-typescript

The repo has no JS/TS source, so the `javascript-typescript` matrix
produced "no source code seen" failures on every CodeQL run, blocking
all PRs (incl. the rustls-webpki CVE bump in this PR). Switch to the
`actions` extractor (scans workflow files, which every repo has), matching
the canonical 007 codeql.yml. Per hypatia rule `codeql_language_matrix_mismatch`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -30,7 +30,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - language: javascript-typescript
+          # Repo has no JS/TS source — `javascript-typescript` matrix
+          # produced "no source files" failures on every CodeQL run.
+          # Switch to `actions` extractor (scans workflow files which
+          # every repo has). Per hypatia rule `codeql_language_matrix_mismatch`.
+          - language: actions
             build-mode: none
 
     steps: