ci: harden workflows with least-privilege permissions, CodeQL, and actionlint

[muralx]

Tighten the CI/CD supply chain to close OpenSSF Scorecard gaps.

Changes

• Least-privilege permissions — set a top-level permissions: contents: read on the backport-fixes, ci, cut-release, dependency-review, publish-pypi, and release workflows; jobs re-grant only the write scopes they need.
• CodeQL SAST — new codeql.yml running the security-extended query suite over the Python sources on pushes, pull requests, and a weekly schedule. The analyze job is gated on public-repo visibility, since SARIF upload to code scanning requires a public repo (and this keeps private forks from failing).
• Workflow linting — new workflows-lint.yml running actionlint on changes under .github/workflows/**. The actionlint installer is fetched by commit SHA and sha256-verified before it runs (closes Scorecard's "downloadThenRun not pinned by hash" gap), and shellcheck is wired in explicitly.
• publish-pypi artifact check — replace the fragile grep-based artifact version check with a compgen -G glob match, so version verification no longer depends on regex-escaping the version string.

Validation

• actionlint passes on all workflows.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.