CI: Establish working CodeQL nightly scan

[lavrovvalera]

What

The CodeQL nightly workflow exists in .github/workflows/codeql.yml but has never produced a successful scan. The job fails at the analysis step with no C/C++ code processed.

Background

Two working reference implementations exist within the eclipse-score organisation that can be used as a basis:

• eclipse-score/communication — uses a dedicated quality/static_analysis:codeql_lint Bazel target. This approach also supports running the scan locally.
• eclipse-score/reference_integration — uses build-mode: none (source-level scan, no build tracing required), which is the simplest approach.

Both references also use the non-deprecated github/codeql-action@v4 (the current workflow pins @v3, which produces deprecation warnings in CI logs).

Acceptance Criteria

• The CodeQL nightly run completes successfully and SARIF results are visible in the GitHub Security tab of eclipse-score/time.
• No CodeQL job failures in consecutive nightly runs.
• The chosen approach is documented or a Bazel target is provided so that the scan can be run locally by a developer without relying on GitHub Actions.
• github/codeql-action is updated to @v4.