Evaluate CodeQL static analysis in baselibs for C++ code

### What

Evaluate the CodeQL-based static analysis approach introduced in [eclipse-score/communication](https://github.com/eclipse-score/communication/tree/main/quality/static_analysis) for use in the baselibs repository.

The communication repo runs CodeQL with the `codeql/misra-cpp-coding-standards` pack via a Bazel-traced build (`codeql_lint.py`, `config.yaml`), producing SARIF and CSV reports. The goal is to validate this approach against the baselibs C++ codebase and determine what is needed to make it reusable in the `score_tooling` module.

### Acceptance Criteria (DoD)

- CodeQL analysis is run on baselibs C++ code (on a branch or test pipeline) using the approach from [communication/quality/static_analysis](https://github.com/eclipse-score/communication/tree/main/quality/static_analysis), producing a SARIF and/or CSV report.
- The `coding-standards.yaml` justification mechanism is validated. Additionally, the in-code deviations are tested. See https://github.com/github/codeql-coding-standards/blob/main/docs/user_manual.md#deviation-code-identifier-comments
- Any baselibs-specific adaptation needs (e.g. Bazel target patterns, `--config=codeql` bazelrc entries, MODULE.bazel dependencies) are identified and documented.
- A short findings summary with actionable recommendations for making the solution reusable in `score_tooling` is added as a comment to this issue.