[CodeQL] Enable GitHub Actions Workflows security analysis

Reference:
https://github.blog/changelog/2025-04-22-github-actions-workflow-security-analysis-with-codeql-is-now-generally-available/

May need to update https://github.com/cli/cli/blob/trunk/.github/workflows/codeql.yml for the matrix stragety with `actions` and `go` as suggested here:

https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning#changing-the-languages-that-are-analyzed

Start with .github/workflows/codeql.yml and compare its matrix strategy with the linked GitHub documentation. Check whether the matrix includes actions and go for CodeQL analysis, then verify that the workflow configuration enables GitHub Actions workflow security analysis.

Written by the indexing model from the issue text.