fix(codeql): restore what the conversion dropped (#44)

Repairs the CodeQL conversion already merged here. The pull request that
made it described the change as carrying triggers over unchanged and as
a pure definition move. Neither was true for this repository.

## What was lost

- **`queries: security-extended`** — a **superset** of the default
suite. The conversion did not carry it, so this repository has been
analysing strictly less than before the move. In the workflow whose
entire purpose is coverage.
- **`workflow_dispatch`** and/or the **concurrency group**, depending on
what this repository declared. Without the group, repeated pushes to a
branch can leave several analyses of the same ref running at once.

## How this was determined

By reading this repository's own pre-conversion file, not a template.
The original premise — that the ten copies were byte-identical — was
wrong: six ran `security-extended`, five declared `workflow_dispatch`,
six had a concurrency group, and the pinned action revision differed
across three versions. Centralising on what one of them happened to
contain is what caused the regression.

The reusable workflow gained a `queries` input and moved to `v4.37.4` —
the newest revision already in use — in
[`bymaxone/.github#23`](bymaxone/.github#23).

Author: msalvatti

.github/workflows/codeql.yml

@@ -19,10 +19,7 @@ jobs:
     # Declared on the calling job, which is the only place that reaches the
     # called workflow: a job that sets its own permissions replaces the
     # workflow-level set rather than intersecting with it, and a called
-    # workflow cannot be granted more than its caller holds. Leaving this
-    # block out and relying on a workflow-level `contents: read` is what
-    # made the first attempt fail to start: security-events: write, which
-    # uploading SARIF requires, was above the ceiling the job had inherited.
+    # workflow cannot be granted more than its caller holds.
     permissions:
       contents: read
       security-events: write