GitHub security workshop: Add a deterministic CodeQL scanning lab

Goal

Teach learners how to enable code scanning and observe a real, intentionally introduced CodeQL finding in the pets application.

Scope

Add one safe training change that is detected reliably by a documented Python CodeQL query. The vulnerable path should be realistic enough to teach source-to-sink reasoning, but isolated from normal workshop startup and clearly marked as training-only. Provide a maintainer verification procedure so dependency or query-suite updates cannot silently break the exercise.

Acceptance criteria

• The exercise explains default setup versus advanced setup and selects one tested path.
• Learners enable CodeQL using current, capability-based instructions.
• A training fixture or guided code change triggers a named CodeQL query deterministically.
• The fixture contains no real secret, external side effect, or production deployment path.
• Learners trigger analysis on a branch or pull request and can identify the resulting check.
• The expected query ID, severity, file, and vulnerable data flow are documented for maintainers.
• A repeatable validation step proves the expected alert appears.
• Cleanup/reset instructions return the repository to a safe state.

Start by reviewing the pets application and the workshop's existing setup guidance, then compare default and advanced CodeQL setup options. Define a training-only fixture or guided change and document the named query, severity, file, data flow, branch or pull request trigger, validation step, and cleanup procedure. Done means the alert appears reliably without secrets, side effects, or a production path.