ci: set CodeQL language matrix to actions (no JS/TS source in repo)

codeql.yml declared `javascript-typescript`, but the repo has no JS/TS source,
so the analyze job recorded zero results / failed "no source files" every run.
CodeQL's `actions` language scans the workflow files (present in every repo),
giving real SAST signal. Per the repo's Hypatia workflow_audit finding.

https://claude.ai/code/session_017TXizM5c1Yd9HWf7Y15YH2

Author: claude

.github/workflows/codeql.yml

@@ -27,7 +27,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - language: javascript-typescript
+          - language: actions
             build-mode: none
     steps:
       - name: Checkout