Add CodeQL workflow

[XhmikosR]

There's a ReDoS issue in the upstream project; this should detect such issues.

PS. I really think it's of everyone's best interest if this fork was merged with upstream. I'll try to get in touch with mysticatea too.

[codecov-commenter]

Codecov Report

Merging #65 (be8969e) into master (8e72b7c) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master      #65   +/-   ##
=======================================
  Coverage   92.66%   92.66%           
=======================================
  Files          23       23           
  Lines         477      477           
=======================================
  Hits          442      442           
  Misses         35       35           

Flag	Coverage Δ
ubuntu-latest-12	92.56% <ø> (ø)
ubuntu-latest-14	92.56% <ø> (ø)
windows-latest-12	92.47% <ø> (ø)
windows-latest-14	?

Flags with carried forward coverage won't be shown. Click here to find out more.

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update b8356ed...be8969e. Read the comment docs.

[bcomnes]

I haven't had a chance to try out CodeQL. The upstream warnings I believe were addressed when I updated some dependencies a while ago. I'd be willing to try this out and see if it generates any useful information.

[XhmikosR]

This is the ReDoS upstream issue https://lgtm.com/projects/g/mysticatea/npm-run-all?mode=list

GitHub has bought semmle so CodeQL should highlight such issues.