feat: add ci checks

[zhongliang02]

Context

This repo contains a custom codeql config which is used by some repos in their workflows.
In a previous incident, updating the codeql config resulted in failures in another project's pipeline.

Approach

This PR adds a ci.yml that is similar to what other repos use in their codeql workflow.

• It checks out itself as the base repo to run codeql on.
• It then runs codeql with the updated config, so any errors in the config will cause the workflow to fail.
• This workflow will run for all PRs.

If the workflow succeeds, it means that the configuration will not break builds in the future (barring the removal of codeql packs from our container registry)

We should make sure that merging is blocked if this workflow fails.

Testing

Will test with a nonexistent codeql pack afterwards

[zhongliang02]

Test case:
#6 is blocked from merging.