fix(ci): point CodeQL at actions so SAST runs on every commit

fix(ci): point CodeQL at actions so SAST runs on every commit #247