Add maintained code scanning and automated dependency update workflows

Follow-up to #90 (reviewed at 31588e1). This tracks work intentionally kept separate from the modernization PR.

Current state

As checked on 2026-09-11, GitHub reports CodeQL default setup as not-configured. The repository contains a build workflow but no checked-in CodeQL or Dependabot configuration.

The project would benefit from ongoing checks after the one-time dependency updates in #90.

Acceptance criteria

• Choose one maintained CodeQL setup (default or advanced) appropriate for this Maven reactor; configure PR/default-branch and scheduled analysis as appropriate, without duplicate scan jobs.
• Confirm analysis includes the intended Java modules and relevant workflow code, and document the optional Jakarta test application's coverage.
• Establish dependency/Actions update automation with sensible grouping and cadence; cover the optional test-app POM as well as the published library modules.
• Treat the deliberately pinned Felix 5.6.12 OSGi R6 test fixture as a documented compatibility fixture: do not silently upgrade it away, and review any applicable advisories rather than blanket-suppressing findings.
• Review dependency alerts by runtime/test/build scope; document ownership and a triage process without disabling meaningful security checks.
• Preserve least-privilege permissions, keep secrets away from untrusted PR execution, and validate action changes with actionlint.
• Require the normal tests and consumer-contract checks for automated update PRs; do not enable unattended merges of packaging-sensitive changes.

Reference: GitHub code-scanning setup documentation.

Examinez le workflow de build existant et le reactor Maven, notamment le POM de l’application de test facultative et le fixture Felix 5.6.12 épinglé. Vérifiez ensuite les exigences de CodeQL et de mise à jour des dépendances, les permissions selon le principe du moindre privilège et la validation par actionlint. La tâche est terminée lorsque les workflows maintenus couvrent les modules et les périmètres de mise à jour prévus, préservent les tests requis et les vérifications des contrats consommateurs, et documentent les décisions de triage et de compatibilité.