Add advanced CodeQL setup to replace broken default setup

[dduugg]

Summary

• The Gusto enterprise-level security config (Gusto Default Advanced Security, enforced) disables code scanning default (automatic) setup org/enterprise-wide.
• That has left this repo's default CodeQL setup stuck erroring since the policy took effect, matching the pattern found and fixed in rubyatscale/query_packwerk#37.
• Adds .github/workflows/codeql.yml, an explicit advanced setup workflow. Pushing an advanced CodeQL workflow causes GitHub to automatically supersede the broken default-setup state, since advanced setup isn't subject to the same enterprise policy.

Test plan

• Merge and confirm the CodeQL workflow runs successfully on main
• Confirm the code scanning status page no longer reports configuration errors

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.