Add maintained code scanning and automated dependency update workflows

Follow-up to #90 (reviewed at 31588e1). This tracks work intentionally kept separate from the modernization PR.

Current state

As checked on 2026-09-11, GitHub reports CodeQL default setup as not-configured. The repository contains a build workflow but no checked-in CodeQL or Dependabot configuration.

The project would benefit from ongoing checks after the one-time dependency updates in #90.

Acceptance criteria

• Choose one maintained CodeQL setup (default or advanced) appropriate for this Maven reactor; configure PR/default-branch and scheduled analysis as appropriate, without duplicate scan jobs.
• Confirm analysis includes the intended Java modules and relevant workflow code, and document the optional Jakarta test application's coverage.
• Establish dependency/Actions update automation with sensible grouping and cadence; cover the optional test-app POM as well as the published library modules.
• Treat the deliberately pinned Felix 5.6.12 OSGi R6 test fixture as a documented compatibility fixture: do not silently upgrade it away, and review any applicable advisories rather than blanket-suppressing findings.
• Review dependency alerts by runtime/test/build scope; document ownership and a triage process without disabling meaningful security checks.
• Preserve least-privilege permissions, keep secrets away from untrusted PR execution, and validate action changes with actionlint.
• Require the normal tests and consumer-contract checks for automated update PRs; do not enable unattended merges of packaging-sensitive changes.

Reference: GitHub code-scanning setup documentation.

Überprüfe den bestehenden Build-Workflow und den Maven-Reaktor, einschließlich der POM der optionalen Testanwendung und des festgelegten Felix-5.6.12-Fixtures. Überprüfe anschließend die Anforderungen von CodeQL und für Dependency-Updates, Berechtigungen nach dem Prinzip der geringsten Privilegien sowie die actionlint-Validierung. Als abgeschlossen gilt die Aufgabe, wenn die gepflegten Workflows die vorgesehenen Module und Update-Umfänge abdecken, die erforderlichen Tests und Consumer-Contract-Prüfungen beibehalten und Triage- sowie Kompatibilitätsentscheidungen dokumentieren.