CI: add CodeQL workflow and harden Actions workflows

[AndreyVMarkelov]

Fixes CodeQL language:actions findings and adds a real scanning workflow.

Changes

• codeql.yml (new): scans actions + python on push/PR to main and weekly (Mon 00:00 UTC). Replaces reliance on stale default-setup scans.
• spec_update.yml: migrate deprecated ::set-output (disabled by GitHub in 2023) to $GITHUB_OUTPUT; pass interpolated ${{ }} values via env: to close shell-injection findings.
• pypiupload.yml: add top-level least-privilege permissions: contents: read, matching the other workflows.

Verification

• All workflow YAML parses.
• actionlint clean (no injection/permission/set-output errors).
• Simulated the new $GITHUB_OUTPUT heredoc with a multiline commit body containing %, $, backticks — preserved literally, confirming the old escaping is no longer needed.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 65.19%. Comparing base (75ec373) to head (ae489eb).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #547   +/-   ##
=======================================
  Coverage   65.19%   65.19%           
=======================================
  Files          34       34           
  Lines       65205    65205           
  Branches     4642     4642           
=======================================
  Hits        42508    42508           
  Misses      22536    22536           
  Partials      161      161           

Flag	Coverage Δ
integration	65.04% <ø> (ø)
unit	64.80% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.