ci(codeql): restore C++ CodeQL analysis

[mvillmow]

Restores CodeQL coverage for the C++ codebase after the managed dynamic workflow went python-only (2026-08-08). The new committed workflow analyzes `cpp`, `python`, and `actions` with canonical `security/codeql-*` names, installs Conan deps before the C++ autobuild, and ignores build artifacts via `.github/codeql/codeql-config.yml` (paths-ignore `build/**`).\n\nCloses #655

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[mvillmow]

Closing as superseded (duplicate of #664)

C++ CodeQL analysis was already restored on main by a different approach, so this PR and that fix are mutually exclusive.

What landed instead

Commit 0232e1b — "fix(codeql): restore C++ analysis + de-static Google Benchmark functions (#657)" — restored C++ analysis inside the existing required workflow rather than extracting it into a new one:

• .github/workflows/_required.yml:1008 — # Restored from the deleted workflow (c-cpp manual build + python).
• .github/workflows/_required.yml:1023 — - language: c-cpp in the analysis matrix
• .github/workflows/_required.yml:1040-1048 — the C++ manual build steps, gated on matrix.language == 'c-cpp'

main's Analyze (c-cpp/python) check reports success.

Why this conflicts

This PR adds a standalone .github/workflows/codeql.yml. #657 instead keeps the analyze job inside _required.yml specifically so it stays a required status context under the homeric-main-baseline ruleset — extracting it to its own workflow would take it out of the required set, reintroducing the gap #657 closed (79e8e0e: "so every job is a required check via the homeric-main-baseline ruleset").

Related

Duplicate of #664 (identical title, goal, and approach — both add .github/workflows/codeql.yml, and neither touches _required.yml). #664 is closed in the same pass.

Verified against origin/main at the time of closing.