fix(ci): point CodeQL at actions so SAST runs every commit (#72)

fix(ci): point CodeQL at actions so SAST runs every commit (#72) #131