Add repository CodeQL workflow for JS/TS to restore PR alert delta analysis

[Copilot]

This PR adds an explicit CodeQL workflow so the main branch has a stable JavaScript/TypeScript scanning configuration. This addresses the “configuration not found” warning that prevented GitHub from computing PR-introduced code scanning alerts.

• Workflow definition

  • Add .github/workflows/codeql.yml with a dedicated analyze job for javascript-typescript.
  • Configure security-and-quality query pack.

• Trigger coverage

  • Run on:
    • push to main
    • pull_request targeting main
    • weekly schedule (0 0 * * 0, Sunday midnight UTC)

• Action versions

  • Use CodeQL actions pinned to v2 for both initialization and analysis, matching the requested setup.

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]
  schedule:
    - cron: "0 0 * * 0"

- uses: github/codeql-action/init@v2
  with:
    languages: javascript-typescript
    queries: security-and-quality
- uses: github/codeql-action/analyze@v2

[bolt-new-by-stackblitz]

Run & review this pull request in StackBlitz Codeflow.