Enforce ruff lint + format in CI and pre-commit, clear the baseline, and fix the CodeQL findings

Enforce ruff lint + format in CI and pre-commit, clear the baseline, and fix the CodeQL findings #658