Add maintained code scanning and automated dependency update workflows

Follow-up to #90 (reviewed at 31588e1). This tracks work intentionally kept separate from the modernization PR.

Current state

As checked on 2026-09-11, GitHub reports CodeQL default setup as not-configured. The repository contains a build workflow but no checked-in CodeQL or Dependabot configuration.

The project would benefit from ongoing checks after the one-time dependency updates in #90.

Acceptance criteria

• Choose one maintained CodeQL setup (default or advanced) appropriate for this Maven reactor; configure PR/default-branch and scheduled analysis as appropriate, without duplicate scan jobs.
• Confirm analysis includes the intended Java modules and relevant workflow code, and document the optional Jakarta test application's coverage.
• Establish dependency/Actions update automation with sensible grouping and cadence; cover the optional test-app POM as well as the published library modules.
• Treat the deliberately pinned Felix 5.6.12 OSGi R6 test fixture as a documented compatibility fixture: do not silently upgrade it away, and review any applicable advisories rather than blanket-suppressing findings.
• Review dependency alerts by runtime/test/build scope; document ownership and a triage process without disabling meaningful security checks.
• Preserve least-privilege permissions, keep secrets away from untrusted PR execution, and validate action changes with actionlint.
• Require the normal tests and consumer-contract checks for automated update PRs; do not enable unattended merges of packaging-sensitive changes.

Reference: GitHub code-scanning setup documentation.

Revisa el workflow de build existente y el reactor de Maven, incluidos el POM de la aplicación de pruebas opcional y el fixture fijado de Felix 5.6.12. Después, comprueba los requisitos de CodeQL y de actualización de dependencias, los permisos de mínimo privilegio y la validación de actionlint. Se considera terminado cuando los workflows mantenidos cubren los módulos y ámbitos de actualización previstos, conservan las pruebas requeridas y las comprobaciones de contratos de consumidores, y documentan las decisiones de triaje y compatibilidad.