setup Codeql workflow

[mmorel-35]

Please add a summary of your change

• setup Codeql workflow to help identify vulnerabilities.

Does your change fix a particular issue?

• Potentially unsafe external link
• Incorrect conversion between integer types

Please indicate you've done the following:

• Accepted the DCO. Commits without the DCO will delay acceptance.
• Created a changelog file or added /kind changelog-not-required as a comment on this pull request.
• Updated the corresponding documentation in site/content/docs/main.

[codecov]

Codecov Report

Attention: Patch coverage is 66.66667% with 1 line in your changes missing coverage. Please review.

Project coverage is 58.66%. Comparing base (f7c0244) to head (e8c46fd).
Report is 294 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/plugin/framework/common/server_errors.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7614   +/-   ##
=======================================
  Coverage   58.66%   58.66%           
=======================================
  Files         344      344           
  Lines       28731    28731           
=======================================
  Hits        16854    16854           
  Misses      10448    10448           
  Partials     1429     1429           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[blackpiglet]

I'm trying to understand the benefit of this PR.
To me, this PR enables the CodeQL scanning on the PR.

Velero repository already enabled the CodeQL scanning per week. I don't know whether they do the same job.

[mmorel-35]

This explicit the configuration and allows customization

[mmorel-35]

Hi @blackpiglet ,

Just another reason to define the workflow instead of using github config, this make the workflow visible by Velero's clients and also to OpenSSF, see https://securityscorecards.dev/viewer/?uri=github.com/vmware-tanzu/velero . On SAST section, it doesn't know that you are actually using CodeQL