ci: add CodeQL workflow analysis and Dependabot for GitHub Actions

[mgarbs]

Description:

Raise the repository's OpenSSF Scorecard score by adding static analysis of the GitHub Actions workflows. The repo already scores 10 on Token-Permissions, Pinned-Dependencies, Binary-Artifacts and Dangerous-Workflow; SAST is currently 0 because no analysis tool runs on any commit.

The only language GitHub reports for this repo is Shell (a git hook), so the CodeQL matrix is limited to the actions language, which analyses the workflow YAML in .github/workflows/ for injection, unpinned-action and permission issues. This is applicable even for a docs-only repo, since gitbook-auto-signoff.yml runs with contents: write and force-pushes to master.

Changes:

SAST

• Add .github/workflows/codeql.yml (language actions, build-mode none) triggered on push/pull_request to master and a weekly schedule. Runs on hl-docs-lin-md like link-check.yml, uses the same harden-runner (v2.20.0) and actions/checkout (v4.2.2) SHA pins already used in this repo, and pins github/codeql-action to v4.37.9. Top-level permissions is contents: read; security-events: write is granted only at job level.
• Remove sast from the not-applicable annotation in .scorecard.yml, since a SAST tool now runs here. The packaging, signed-releases and fuzzing annotations are unchanged.

Dependency freshness

• Add .github/dependabot.yml for the github-actions ecosystem (weekly) so the SHA pins in the workflows keep receiving update PRs.

Check	Before	After (local scorecard --local)
SAST	0	10 (7 immediately on the public cron, 10 once the workflow has run on PRs)
Token-Permissions	10	10
Pinned-Dependencies	10	10
Binary-Artifacts	10	10
Dangerous-Workflow	10	10

Intentionally not changed:

• Fuzzing: still annotated as not-applicable (no fuzzable code in this repo).
• link-check.yml downloads a lychee release tarball with curl and executes it; scorecard does not flag this as downloadThenRun, so it is left as is. Pinning the tarball to a checksum could be a follow-up.
• Existing workflow pins (harden-runner v2.12.0 / v2.20.0, checkout v4.2.2) are left alone; Dependabot will propose bumps.
• .github/audits/rules.md (Exception 2) records that a Dependabot configuration is not required here because the repo only contains bash scripts. The dependabot.yml added in this PR covers only the github-actions ecosystem, i.e. the SHA pins in the three workflow files, so that exception becomes moot once this merges. I have not edited rules.md; if you would rather keep the exception as recorded, drop dependabot.yml from this PR and the CodeQL change stands on its own.

Related issue(s):

N/A

Notes for reviewer:

Verification:

• actionlint .github/workflows/codeql.yml reports only the pre-existing "unknown self-hosted label hl-docs-lin-md" notice, same as link-check.yml.
• scorecard --local . --checks Token-Permissions,Pinned-Dependencies,Binary-Artifacts,Dangerous-Workflow,SAST,Fuzzing gives the table above.
• The CodeQL / Analyze (actions) check on this PR is the first run of the new workflow.

Checklist

• Documented (Code comments, README, etc.)
• Tested (unit, integration, etc.)

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[mgarbs]

Some context on the intent behind this PR: it's part of a coordinated effort to raise the OpenSSF Scorecard scores across the hiero-ledger org. Scorecard is an automated 0–10 rating of a repository's supply-chain security practices — workflow token permissions, dependency pinning, SAST coverage, committed binaries, fuzzing, and similar checks — and it's what the org's security dashboard tracks.

The checks this PR moves (measured with scorecard --local on this branch): SAST 0→7. The published score is currently 7.7 and the projection once this merges and the weekly Scorecard cron re-runs is ≈8.1.

The CodeQL job (actions language) already ran green on this PR.