[nachocodoner]

Add CodeQL scanning and address the workflow hardening findings from the initial baseline.

Set the integration-test workflow to read-only contents access and pin the existing Meteor setup action ref.

CodeQL covers JavaScript/TypeScript and GitHub Actions on the configured mainline branches, weekly and by manual dispatch. The existing query suite and extraction scope are unchanged. Permission changes retain required job access, and action pins resolve existing refs without version upgrades. Commands, triggers and application source are unchanged.

Validation: full branch rescan passed at 9d806c9563c28d5c3d9d36acac5469a6ace2b38b, with both upload categories and unrestricted query execution verified. Workflow findings fell from 1 to 0; 0 JavaScript/TypeScript findings remain for triage. No alerts were dismissed.

PR delta validation: CodeQL PR scan passed at the same amended head, with zero results in both JavaScript/TypeScript and Actions. Logs verify the PR diff-range extension was used, and uploaded analyses match the merge of this head with the target branch. The full branch rescan above independently confirms the targeted workflow findings are absent; remaining source findings stay in triage.

YAML comparison confirms only permissions and action refs changed. Whitespace checks passed with existing line endings preserved. Actionlint introduced no new diagnostics.

Existing CI: Meteor CI success.

Review remaining findings and coverage, then verify mainline scanning after merge.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.