Add CodeQL code scanning workflow

[claude]

Requested by William Storey, Greg Oschwald · Slack thread

---

What: mmdbconvert currently runs no static analysis. This adds GitHub CodeQL code scanning, so security/quality issues in the Go code are flagged on every pull request and on a weekly schedule — matching every other Go repo in the org (mmdbinspect, mmdbwriter, geoipupdate, etc.).

How: Adds .github/workflows/codeql-analysis.yml, mirroring the org's existing CodeQL workflow (Autobuild for Go, github/codeql-action v4.37.0 pinned by SHA, weekly schedule + pull_request triggers). Also adds a codeql group to the github-actions Dependabot ecosystem (patterns: github/codeql-action*) so the codeql-action sub-action bumps arrive as a single grouped PR, consistent with STF-983.

Note: the Dependabot change overlaps STF-983's open PR for this repo; this is expected to merge first.

---

Generated by Claude Code

[claude]

Closing as redundant. mmdbconvert already runs CodeQL via GitHub's built-in "default setup" — the dynamic github-code-scanning/codeql workflow, active with 170+ successful runs. An advanced CodeQL workflow can't coexist with default setup (that's why Perform CodeQL Analysis failed here on SARIF upload), so no workflow file is needed. Leaving the repo on default setup.

[claude]

Reopening — default setup has been disabled on this repo, so the advanced CodeQL workflow can now upload results. Expecting green CI this time.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.