ci: add CodeQL security scanning

Signed-off-by: Sora Morimoto <sora@morimoto.io>

Author: smorimoto

.github/workflows/codeql.yml

@@ -0,0 +1,21 @@
+name: CodeQL
+
+on:
+  pull_request:
+  push:
+  schedule:
+    - cron: 0 0 * * 0
+
+jobs:
+  codeql:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v1
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@v1