[Feature]: Add a CodeQL analysis workflow to the GitHub templates

Nobody has claimed this yet.

### Background and motivation

The generated workflow already uploads a SARIF file from InspectCode (#50) and requests the `security-events: write` permission, so all the plumbing for GitHub code scanning is in place. Adding a CodeQL workflow is therefore a small step that gives generated libraries real security analysis rather than style analysis.

Proposal: add a `.github/workflows/codeql.yml` to the GitHub variants of the template, running on pushes to the main branches, on pull requests, and on a weekly schedule.

### Alternative Concerns

* CodeQL only applies to the GitHub templates. The Azure DevOps variants would need something else, or nothing at all.
* It adds CI time, so a weekly schedule plus pull requests may be a better default than running on every push.
* For private repositories CodeQL requires GitHub Advanced Security, so the generated README should say so and explain how to remove the workflow if it is not available.

### Could you help with a pull-request?

No

Start by locating the GitHub variants and their generated README files, then inspect the existing InspectCode workflow and permissions. Add .github/workflows/codeql.yml to the GitHub templates with push, pull-request, and weekly schedule triggers, and document the private-repository requirement and removal option in the generated README. Confirm the Azure DevOps variants remain unchanged.

Written by the indexing model from the issue text.