chore(NODE-6578): add misc tooling to ZSTD repo

[baileympearson]

Description

What is changing?

This PR contains a smattering of tooling we'll need for the SSDLC release flow (coming in the next PR):

• A release please config and manifest has been added.
• A new build action has been added, that builds the bindings and uploads the to GHA artifact storage (for use in the release action later, coming in a follow-up PR)
• CodeQL has been enabled and configured for both C++ and JS.
• A new SBOM file has been generated, which includes the correct version of zstd as our only bundled dependency.
• The zstd C library version now is specified in the package.json and the install scripts reads the package file to install the correct version of zstd.

Is there new documentation needed for these changes?

What is the motivation for this change?

Double check the following

• Ran npm run format:js && npm run format:rs script
• Self-review completed using the steps outlined here
• PR title follows the correct format: type(NODE-xxxx)[!]: description
  • Example: feat(NODE-1234)!: rewriting everything in coffeescript
• Changes are covered by tests
• New TODOs have a related JIRA ticket

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[aditi-khare-mongoDB]

CodeQL only takes about 2 minutes, is there a reason we put a timeout here and chose 360?

[aditi-khare-mongoDB]

What's the motivation behind this change?