[CI][Feature]: Add deterministic native CodeQL scanning

[kieran-osgood-shopify]

TLDR

Enable CodeQL on all languages we utilise
CodeQL has been silently failing for a while despite showing green on PR's

How

This uses CodeQL Advanced setup with the security-extended query suite and explicit production-only extraction:

• Actions, JavaScript/TypeScript, and Ruby use buildless analysis.
• Android SDK/protocol and React Native Android compile into separate Java/Kotlin databases.
• Core Swift and React Native iOS compile into separate Swift databases.
• Native SARIF is allowlisted to shipped source roots, excluding tests, samples, dependencies, and generated build output.
• Native change detection avoids unrelated platform builds while the workflow still runs on every ready PR, ensuring GitHub's aggregate CodeQL status always materializes.

A normal traced xcodebuild contained all 93 production Swift files but omitted executable control-flow and data-flow bodies for most Swift package dependency methods. The core Swift job therefore:

1. builds the real package and generated resource accessors before CodeQL initialization;
2. emits importable dependency modules in package order outside tracing; and
3. traces exactly one focused swiftc -typecheck pass for each production module after initialization.

React Native iOS separately type-checks the six shipped wrapper sources against the published Shopify SDK and a minimal React declaration shim. This preserves real SDK type checking without tracing React Native's full CocoaPods dependency graph.

Future

We might want to explore whether there is better tooling available to Shopify for native applications, this has proved painful to setup and took an agent half a day of churn to setup

How to test

GIVEN the current-head CodeQL workflow run is complete

WHEN the reviewer opens https://github.com/Shopify/checkout-kit/actions/runs/34612331981

THEN Actions, JavaScript/TypeScript, Ruby, Android, React Native Android, Swift, and React Native iOS analysis should all be green

AND the GitHub Advanced Security aggregate CodeQL check should be green

---

GIVEN disposable canary PR #760 exercised every analysis path and is closed

WHEN the reviewer opens https://github.com/Shopify/checkout-kit/security/code-scanning/10

THEN CodeQL should show swift/unsafe-webview-fetch at platforms/swift/Sources/ShopifyCheckoutKit/CheckoutWebView.swift:1142 from the canary ref

AND no canary source should exist in either mergeable branch

Verification

• Current clean run: https://github.com/Shopify/checkout-kit/actions/runs/34612331981
• Canary run: https://github.com/Shopify/checkout-kit/actions/runs/34498749383
• Core Swift database: 93 production files and 12,910 lines of code, with substantive flow in 164 ShopifyCheckoutKit, 528 EmbeddedCheckoutProtocol, 25 CheckoutKitTelemetry, and 210 ShopifyAcceleratedCheckouts named functions.
• Default setup remains disabled; Advanced setup uploads are authoritative.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[bitrise]

Checkout Kit E2E results

No E2E tests to run for this change.