ci: add code scanning and require code owners

[kriptoburak]

Summary

• require code-owner review for every path
• add pinned CodeQL analysis for repository scripts
• add pinned OpenSSF Scorecard reporting

Security Design

• actions use immutable commit pins
• checkouts never persist credentials
• jobs use minimal scoped permissions
• Scorecard runs only after trusted pushes and schedules
• CodeQL uses extended security queries

Validation

• both listed owners have write permission
• protected-branch review settings remain enforced
• actionlint passes
• Node syntax checks pass
• git diff --check passes

Note

Add CodeQL scanning, OpenSSF Scorecard, and CODEOWNERS to the repository

• Adds a CodeQL workflow that runs JavaScript/TypeScript security analysis on push and pull requests to main and on a weekly schedule, reporting results to GitHub code scanning.
• Adds an OpenSSF Scorecard workflow that runs on push to main and weekly, publishing SARIF results to GitHub code scanning and retaining them as artifacts for 5 days.
• Adds a CODEOWNERS file assigning repository-wide review requirements to @kriptoburak and @furkanerday.

^{Macroscope summarized 23b67d5.}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[furkanerday]

Reviewed the complete diff, description, commit history, checks, discussion, repository policy, relevant contracts, tests, dependency and release integrity, licensing, and public-safety implications. Required checks are green and no actionable review threads remain.

[furkanerday]

Human-authored commits 1566abd, d02ad62, 23b67d5 lack author-matching Signed-off-by trailers. Each author must amend their own affected commit and re-push it; a later maintainer commit cannot cure an earlier contributor commit. Re-request review after the rewritten commit history and required checks complete.