chore: apply ci hardening (#1)

- chore: apply 'Harden Runner' auditing to all ci tasks
- chore: apply `persist-credentials: false` to checkout tasks
- chore: publish dependency graph and add dependency review check
- chore: add codeql scan job (temp)

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
Signed-off-by: Sam Gammon <sam@elide.ventures>

.github/workflows/codeql.yml

@@ -35,7 +35,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: ["java", "javascript"]
+        language: ["java"]
         # CodeQL supports [ $supported-codeql-languages ]
         # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support