GitHub security workshop: Add a custom CodeQL query exercise

Goal

Teach how CodeQL can enforce an organization-specific security rule that is not represented by the default query suite.

Scope

Choose one simple, app-relevant Python pattern and provide a small starter query that learners can understand and extend. Document the tested execution path using supported CodeQL tooling, then show how a query pack or configuration is incorporated into repository analysis.

Acceptance criteria

• The target pattern is security-relevant, specific to the pets app, and has a deterministic positive and negative example.
• The exercise explains the query metadata, imports, predicates, result selection, and help text at an introductory level.
• A pinned/tested CodeQL CLI or supported hosted workflow is documented.
• Learners run the query and see exactly the expected result set.
• The custom query is packaged and referenced using a currently supported CodeQL configuration.
• A subsequent repository analysis reports the custom result with recognizable metadata.
• Maintainer validation detects query compilation failures and result drift.
• The exercise documents feature or plan constraints and an observation-only fallback.

Start with the pets app's Python code and the supported CodeQL CLI or hosted-workflow path described in the issue. Define one deterministic positive and negative example, then document the starter query, packaging, configuration, expected results, validation, constraints, and fallback so the exercise meets every acceptance criterion.