[rennf93]

Code scanning now covers every language CodeQL supports in this repository, and the required code-ql check reports on every PR.

• One job named code-ql scans rust,actions. It scanned only rust before.
• actions scans the workflows themselves: script injection, untrusted checkouts, missing token permissions.
• The check reported as Analyze (rust), so the ruleset's required code-ql check never reported.
• Runs on pushes to master too, so the default branch's analysis is current and not only weekly.
• category keeps the earlier value, so the existing analyses and alerts carry over instead of going stale.

Checked: actionlint passes on the workflow. The CodeQL run on this PR is the real test.