GitHub security workshop: Add a custom CodeQL query exercise

Goal

Teach how CodeQL can enforce an organization-specific security rule that is not represented by the default query suite.

Scope

Choose one simple, app-relevant Python pattern and provide a small starter query that learners can understand and extend. Document the tested execution path using supported CodeQL tooling, then show how a query pack or configuration is incorporated into repository analysis.

Acceptance criteria

• The target pattern is security-relevant, specific to the pets app, and has a deterministic positive and negative example.
• The exercise explains the query metadata, imports, predicates, result selection, and help text at an introductory level.
• A pinned/tested CodeQL CLI or supported hosted workflow is documented.
• Learners run the query and see exactly the expected result set.
• The custom query is packaged and referenced using a currently supported CodeQL configuration.
• A subsequent repository analysis reports the custom result with recognizable metadata.
• Maintainer validation detects query compilation failures and result drift.
• The exercise documents feature or plan constraints and an observation-only fallback.

Inizia dal codice Python della pets app e dal percorso supportato CodeQL CLI o hosted-workflow descritto nell’issue. Definisci un esempio positivo e uno negativo deterministici, quindi documenta la query iniziale, il packaging, la configurazione, i risultati attesi, la validazione, i vincoli e il fallback, in modo che l’esercizio soddisfi tutti i criteri di accettazione.