CodeQL/push workflow fails when rdeps resolves to header-only targets

The CodeQL workflow fails with "CodeQL could not process any code written in C/C++" when a PR modifies a file under `envoy/` or `source/common/` and the `bazel query rdeps(//source/common/..., , 1)` resolves exclusively to header-only targets.

I noticed this in my [PR](https://github.com/envoyproxy/envoy/pull/45039) which adds an include in `load_shed_point.h`.
Due to the diff between the PR and `main` showing `load_shed_point.h` as changed, the workflow detects C++ changes in `envoy/`, queries rdeps, and resolves to the header-only `load_shed_point_interface` target -> triggering the failure.

Is this the expected behavior or can the CodeQL workflow be improved?

Start with the CodeQL/push workflow and reproduce the `bazel query rdeps(//source/common/..., , 1)` case for `load_shed_point.h`. Check how the workflow handles the header-only `load_shed_point_interface` result; done means PRs that change only header-only targets no longer fail with the “could not process any code” message.

Written by the indexing model from the issue text.