Add CodeQL workflow for S360 compliance

[xuxife]

What / Why

AKSFlexNode (module github.com/Azure/AKSFlexNode, primarily Go) has no CodeQL workflow, so it is flagged non-compliant for S360 standard Microsoft.Security.CodeQL.10000 (every active, production repo must publish a non-expired CodeQL snapshot per language).

This adds .github/workflows/codeql.yml that runs CodeQL Go autobuild on:

• every push / PR to main,
• a weekly schedule (cron: "0 7 * * 1"), so a fresh snapshot is uploaded even without commits,
• manual workflow_dispatch.

Pattern mirrors the existing Azure/gpu-provisioner CodeQL workflow (pinned action SHAs, security-events: write, autobuild for Go).

Notes

• Scanning Go only for now (the repo's primary language). If S360 later flags another language for this repo, add it to the matrix.language list.
• Scheduled workflows on low-activity repos can be auto-disabled by GitHub after 60 days of inactivity; re-enable + re-run to refresh if that happens.
• After merge, confirm a fresh go snapshot is attributed to this repo (allow 48–72h).

[github-actions]

Thanks for the contribution! This pull request comes from a fork, so the Azure E2E workflow is intentionally skipped for security reasons.

Merge will remain blocked until the E2E tests have been run from a branch in the Azure/AKSFlexNode repository by a maintainer/contributor with access to this repo.

Maintainer options:

1. Review the fork changes.
2. Push the trusted commit to a branch in Azure/AKSFlexNode.
3. Run the E2E Tests workflow from that same-repository branch, or open a same-repository PR so the workflow can run automatically.

We do not run Azure E2E directly from fork PR code because it requires Azure OIDC access.

[Copilot]

Pull request overview

Adds a GitHub Actions CodeQL workflow to ensure the repository publishes a fresh Go CodeQL snapshot regularly (push/PR to main, weekly schedule, and manual dispatch) to meet S360 CodeQL compliance expectations.

Changes:

• Introduces .github/workflows/codeql.yml to run CodeQL analysis for Go on push, pull_request, schedule, and workflow_dispatch.
• Pins GitHub Actions by SHA and configures security-events: write permissions for SARIF upload.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.