Mac: Try re-enabling CodeQL on non-legacy build again

**What is the current behaviour and why should it be changed?**
In #2564 we've moved the CodeQL logic to the legacy build target. The reason was that enabling CodeQL got the build stuck during release signing. The legacy build is not signed, therefore, the problem didn't appear there.
I'm suspecting that it might be the same cause as #2925. In other words: It might just be that CodeQL builds are slower (they are!) and therefore hit the keychain re-lock timeout, which can be worked around.

**Describe possible approaches**
When #2925 is fixed, we could just re-enable CodeQL for the main build (and disable for legacy).

**Has this feature been discussed and generally agreed?**
No, but if it works, it should be good to go as it was a workaround only.