ci: align codeql settings with Security SIG recommendations

[pichlermarc]

Which problem is this PR solving?

• aligns CodeQL runs with SIG Security recommendations (see Add recommendation around CodeQL  sig-security#15)
• references [security] audit repository tooling #1751

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 90.77%. Comparing base (dfb2dff) to head (e36f9e0).
Report is 249 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2461      +/-   ##
==========================================
- Coverage   90.97%   90.77%   -0.21%     
==========================================
  Files         146      156      +10     
  Lines        7492     7716     +224     
  Branches     1502     1584      +82     
==========================================
+ Hits         6816     7004     +188     
- Misses        676      712      +36     

see 76 files with indirect coverage changes