Add maintained code scanning and automated dependency update workflows

Follow-up to #90 (reviewed at 31588e1). This tracks work intentionally kept separate from the modernization PR.

Current state

As checked on 2026-09-11, GitHub reports CodeQL default setup as not-configured. The repository contains a build workflow but no checked-in CodeQL or Dependabot configuration.

The project would benefit from ongoing checks after the one-time dependency updates in #90.

Acceptance criteria

• Choose one maintained CodeQL setup (default or advanced) appropriate for this Maven reactor; configure PR/default-branch and scheduled analysis as appropriate, without duplicate scan jobs.
• Confirm analysis includes the intended Java modules and relevant workflow code, and document the optional Jakarta test application's coverage.
• Establish dependency/Actions update automation with sensible grouping and cadence; cover the optional test-app POM as well as the published library modules.
• Treat the deliberately pinned Felix 5.6.12 OSGi R6 test fixture as a documented compatibility fixture: do not silently upgrade it away, and review any applicable advisories rather than blanket-suppressing findings.
• Review dependency alerts by runtime/test/build scope; document ownership and a triage process without disabling meaningful security checks.
• Preserve least-privilege permissions, keep secrets away from untrusted PR execution, and validate action changes with actionlint.
• Require the normal tests and consumer-contract checks for automated update PRs; do not enable unattended merges of packaging-sensitive changes.

Reference: GitHub code-scanning setup documentation.

Esamina il workflow di build esistente e il reactor Maven, incluso il POM dell'applicazione di test opzionale e il fixture Felix 5.6.12 bloccato. Verifica quindi i requisiti di CodeQL e degli aggiornamenti delle dipendenze, le autorizzazioni secondo il principio del privilegio minimo e la convalida di actionlint. Il lavoro è completato quando i workflow mantenuti coprono i moduli e gli ambiti di aggiornamento previsti, preservano i test richiesti e i controlli dei contratti dei consumer e documentano le decisioni di triage e compatibilità.