ci: add CodeQL static analysis for Python

[WangLingxun]

Summary

Add a CodeQL static-analysis workflow for the Python codebase. Findings appear
under Security -> Code scanning.

• Triggers: push to main, PRs that touch **/*.py (or this workflow), a
  weekly schedule, and manual dispatch. Intentionally kept off the heavy GPU PR
  path (runs on ubuntu-latest, no secrets).
• security-extended query suite during burn-in; can be narrowed/broadened later.
• All actions pinned to full commit SHAs (consistent with the rest of the repo).

Test plan

• Workflow appears and runs green on push/dispatch.
• Code scanning results show up under the Security tab.
• PR-path filter: a Python change triggers it; a docs-only change does not.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.