ci(codeql): scan actions instead of javascript-typescript (#32)

The repo has no JS/TS sources (language policy bans them; codebase is
Rust/ReScript), so the CodeQL `javascript-typescript` matrix exits with
"no source files" on every run and produces no analysis. Switch the
matrix to `actions`, which scans the workflow files every repo has and
gives the security-events upload something real to report.

https://claude.ai/code/session_017KxkerbS1hjJwipTExFxLc

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -21,7 +21,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - language: javascript-typescript
+          - language: actions
             build-mode: none
 
     steps: