Feat/enable code q bandit

[rabsqueen]

PR Title

feat(ci): enable CodeQL and Bandit SAST workflows

Description

This PR implements static application security testing (SAST) pipelines by introducing integrated workflows for both GitHub CodeQL and Bandit. These tools run concurrently on every pull request to analyze code for security vulnerabilities, software weaknesses, and style flaws before merge integration.

Changes

• CodeQL Implementation: Added .github/workflows/codeql.yml to orchestrate advanced semantic analysis across the codebase, utilizing the security-extended and security-and-quality suites.
• Bandit Integration: Added .github/workflows/bandit.yml to scan Python source trees for common security liabilities and configuration vulnerabilities.
• Native Check Reporting: Configured both scanners to export analysis metrics via standard SARIF format files, directly mapping findings to native GitHub Pull Request check annotations.

Testing Mitigations

• Syntax Validation: Checked workflow structures against schema parsers to ensure flawless runtime step resolution.
• Hook Verification: Confirmed that permissions are correctly isolated to security-events: write for secure results ingestion.

Related Issues

Closes #290
Closes #284

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[YaronZaki]

LGTM