Migrate CodeQL to advanced setup

[zeevdr]

Description

Follow-up to opendecree/decree#183. Migrate from default-setup to advanced-setup so we can paths-ignore generated proto/TS stubs and pin the CodeQL workflow to repo conventions.

Reference: opendecree/decree#190 (advanced workflow for the core repo).

Acceptance criteria

• Disable default-setup: gh api -X PATCH repos/opendecree/decree-typescript/code-scanning/default-setup -f state=not-configured
• Add .github/workflows/codeql.yml with Analyze jobs for actions and javascript-typescript
• Add paths-ignore for generated code: src/generated/**
• Match default-setup's default query suite + remote threat model for findings parity
• Verify advanced-setup flags equivalent findings vs default-setup on the same commit

Notes

Languages currently scanned by default-setup: actions, javascript, javascript-typescript, typescript. CodeQL collapses these to javascript-typescript in advanced-setup.