ci: introduce CodeQL

[mrc0mmand]

Analyze the polkit code using CodeQL [0], to discover potential vulnerabilities before they reach the main branch.

[0] https://codeql.github.com/docs/

---

Once this is merged, it'll do the initial scan and populate the "Code Scanning" tab in the "Security" repo section, like this:

(This tab is accessible only to the repo maintainers, given the sensitive nature of some of the alerts.)

Each alert then shows further information and steps how to remediate it:

I enabled the extended CodeQL queries as well (as I think polkit would benefit from them, given its security nature). However, the extended checks are more prone to false positives, so if that's something you'll find annoying, it can be easily toned back down to only high-precision checks.

The results of the initial scan will be in the Security tab, but any issues introduced in new code will be shown directly in the respective PR that introduced them, so they can be acted on immediately.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.