Add CodeQL workflow for fork PR support

[wurdum]

GitHub's default CodeQL setup does not run on pull requests from forks — a documented security restriction. Since the "Main Rules" ruleset requires the CodeQL check, external contributor PRs (e.g. #816) are permanently blocked.

This adds a .github/workflows/codeql.yml that triggers on pull_request, push to main, weekly schedule, and manual dispatch. It runs C# analysis against Nethermind.Arbitrum.csproj using github/codeql-action v4.

[Copilot]

Pull request overview

Adds a dedicated CodeQL GitHub Actions workflow so the repository has an explicit CodeQL check that can run on PRs (including fork PRs), aligning with the repo’s ruleset requirements.

Changes:

• Introduces .github/workflows/codeql.yml to run CodeQL on pull_request, push to main, scheduled, and manual dispatch.
• Configures CodeQL for C# and builds src/Nethermind.Arbitrum/Nethermind.Arbitrum.csproj on ubuntu-latest.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.38%. Comparing base (197620a) to head (2f16d35).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #825   +/-   ##
=======================================
  Coverage   76.38%   76.38%           
=======================================
  Files         227      227           
  Lines       14150    14150           
  Branches     2107     2107           
=======================================
  Hits        10808    10808           
  Misses       2584     2584           
  Partials      758      758           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[svlachakis]

I guess this will fix dependabot PRs also

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.