ci: fix CI/CD configuration (campaigns C001-C005)

- C001: CodeQL language fixes
- C002: License identifier standardization
- C003: Outdated actions audit
- C004: Pin standards refs to SHA 861b5e9
- C005: Add workflow-level permissions

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -13,7 +13,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions: read-all
 
 jobs:
   placeholder: