Add CodeQL for GitHub Actions

[martincostello]

• Enable scanning GitHub Actions workflows with CodeQL.
• Make permissions job-level rather than workflow-level.
• Do not persist Git credentials.
• Simplify some conditions.
• Use environment variables to make code to push NuGet packages consistent.
• Update branch name.
• Scan the GitHub workflows using zizmor.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[Copilot]

Pull Request Overview

This PR enhances the security and maintainability of GitHub Actions workflows by adding CodeQL scanning for workflow files, improving security practices, and standardizing configurations.

• Adds CodeQL scanning support for GitHub Actions workflows in addition to existing C# code scanning
• Introduces zizmor tool for dedicated GitHub workflow security scanning
• Moves permissions from workflow-level to job-level for better security isolation
• Standardizes environment variable usage for NuGet package publishing

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/update-dotnet-sdks.yml	Updates branch option and moves permissions to job-level
.github/workflows/code-scan.yml	Adds GitHub Actions scanning to CodeQL matrix and introduces zizmor workflow scanner
.github/workflows/build.yml	Enhances security with credential settings, simplifies conditions, and standardizes NuGet publishing variables

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}