Obtain `codeQL` exception from 1es

Looking through the wiki, all our changesets swapping to `1es-templates` just disable `ESLint` and `CodeQL`. I'm thinking that I can remove the disable of `ESLint`, but `CodeQL` definitely needs to stay off.

[Scroll down to `S360 exception process and approvals for disabled tools`](https://eng.ms/docs/cloud-ai-platform/devdiv/one-engineering-system-1es/1es-docs/1es-pipeline-templates/features/sdlanalysis/disablingtools)

To do that long term using official templates, we need to obtain an exception for it. Getting this issue in to track that work.