ci(codeql): scan the 'actions' language (workflow files)

Adds an 'actions' matrix entry (build-mode: none) so CodeQL scans the
repo's GitHub Actions workflows for security issues, alongside the
existing javascript-typescript analysis. Resolves the Hypatia
workflow_audit finding codeql_missing_actions_language.

https://claude.ai/code/session_01XZhw6Fq27eoeyEB4LR3a2c

Author: claude

.github/workflows/codeql.yml

@@ -38,6 +38,8 @@ jobs:
         include:
           - language: javascript-typescript
             build-mode: none
+          - language: actions
+            build-mode: none
 
     steps:
       - name: Checkout