Add CodeQL analysis tool

[gabibguti]

Proposal

Hello, I'm working on behalf of Google and the Open Source Security Foundation (OpenSSF) to help open-source projects improve their supply-chain security. Given kind-of project importance to the JavaScript community, the OpenSSF has identified it as one of the 100 most critical open source projects.

Would you consider adopting an analysis tool called CodeQL? CodeQL scans your code for potential vulnerabilities and reports the results as code scanning alerts. It is developed by GitHub and can help improve the project's security posture.

Would you be interested in a PR adding this tool?

Additional Context

To simplify maintainers' lives, CodeQL can be configured with CodeQL GitHub Action. It runs on every change or pull request to the repository's main branch. This Action is recommended by GitHub and Scorecards.

Let me know if you have any questions!

[gabibguti]

Hi! Frindly ping here, if you'd like I believe a SAST, such as CodeQL, would still be a good addition, but it requires some maintainance. So, let me know if you're interested, otherwise we can close as not planned for now :)