Add codeql.yml reusable workflow.

Create a reusable workflow to configure CodeQL scanning action.

**Problem:**

CodeQL code scanning is currently configured with GitHub's default settings (so, no workflow in our `.github/workflows` directories), in each repo except in `bfb_delivery`, but the default setting does not allow scanning PRs from forked repos. This is a good precaution since that can lead to malicious activity, but it defeats the purpose of requiring code scanning of PRs while allowing PRs from outside contributors who must fork.

**Proposed Solution:**

`bfb_delivery` now has a `.github/workflows/codeql.yml` workflow that configures how code scanning is run, specifically checking out the PR's ref, instead of the forked repo's head ref which could inject malicious workflows. https://github.com/crickets-and-comb/bfb_delivery/blob/main/.github/workflows/codeql.yml

We can use this to create a shared workflow that consuming repos can call from a workflow, as we do with our CI/CD workflow.

**Implementation:**

1. Create a copy of https://github.com/crickets-and-comb/bfb_delivery/blob/main/.github/workflows/codeql.yml in the `shared` repo's workflows directory.
- Modify as needed.
- Change the triggers to only trigger from `workflow_call`. See https://github.com/crickets-and-comb/shared/blob/main/.github/workflows/CI.yml for an example of this trigger.
- Make other necessary changes as testing reveals.

2. Create a calling workflow in `reference_package`.
- See https://github.com/crickets-and-comb/reference_package/blob/main/.github/workflows/PR_CI_CD.yml for an example of consuming a `shared` reusable workflow.
- Unlike that example, use the triggers in workflow we're copying from `bfb_delivery`: https://github.com/crickets-and-comb/bfb_delivery/blob/main/.github/workflows/codeql.yml
- Namely: `push`, `pull_request_target`, `schedule`, and `workflow_dispatch`.
- Merge to main.

3. Test it out.
- Did it work on push to main?
- Does it work on dispatch? (manual trigger from Actions tab in GitHub UI.)
- Does code scanning work on a PR to `reference_package`?
- Does it work on a PR from a forked repo?

4. Repeat for each repo in the org, including testing.

**Note on implementation**

Some repos have different languages to scan. You'll probably need to add those to the shared matrix, because you probably can't add a parameter to pass to the reusable workflow and set the language matrix.

**Alternative approach**

You may face difficulty due, e.g. having trouble calling the CodeQL action from a reused workflow. So, you can try putting the workflow in the org's `.github` repo's workflows directory so that it becomes a default repo in each of the org's repos. This would mean it's not a reusable workflow that's called but one called directly from the repo, just as a copy. It also might mean that it doesn't show up in existing repos, nor would they get updates to it.

**Success**

CodeQL scans run in each repo on push to main, on dispatch, on PRs from within repo and from forks.