ci: add CodeQL workflow for C/C++ analysis (#243)

[IsseiHasegawa]

What

Add a GitHub Actions workflow for CodeQL static analysis at .github/workflows/codeql-analysis.yml.

Why

Issue #243 requests enabling SAST with CodeQL so results are visible in the Security tab and in PR checks.

Changes

• Add CodeQL workflow triggered on:
  • push
  • pull_request
• Configure CodeQL language as cpp (covers C/C++).
• Set required permissions for SARIF upload:
  • contents: read
  • security-events: write
• Exclude non-core path from scanning:
  • libCacheSim-node
• Use manual build mode for better reliability with this CMake/Ninja project:
  • install deps via scripts/install_dependency.sh
  • cmake -G Ninja -B build -DCMAKE_BUILD_TYPE=Release
  • ninja -C build
• Keep workflow minimal with concurrency control to avoid duplicate in-flight runs.

Validation

• Confirm workflow is detected in Actions.
• Confirm CodeQL check appears on PR.
• Confirm code scanning results are uploaded to the Security tab.

Closes #243

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[Copilot]

Pull request overview

Adds a GitHub Actions CodeQL workflow to run C/C++ static analysis for this CMake/Ninja-based project so results appear in GitHub’s Security tab and as PR checks (per issue #243).

Changes:

• Introduces .github/workflows/codeql-analysis.yml to run CodeQL on push and pull_request.
• Uses CodeQL manual build mode with the repo’s dependency install script plus CMake+Ninja build steps.
• Adds concurrency control and ignores scanning libCacheSim-node.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.