Document CodeQL merge protection

[cbusillo]

Summary

• remove generated per-language CodeQL jobs from ordinary required status checks
• document the dedicated CodeQL merge-protection ruleset and alert thresholds
• preserve the repository's non-CodeQL required checks

GitHub settings applied

• require CodeQL through an active code_scanning ruleset on the default branch
• block CodeQL errors and high-or-higher security alerts
• retain strict branch status-check policy without the fragile Analyze (...) contexts

Validation

• jq empty .github/github.json
• prettier --check .github/github.json
• git diff --check