chore: batch dependency updates and analyze workflows with CodeQL

[simonvanlierde]

Supersedes #182, #183, #184, #187, #188 — batched into one branch so CI runs once. Also carries a CodeQL change that was sitting uncommitted.

Source PR	Contents
#187	clamav 1.5.4, cloudflared 2026.8.3, grafana/alloy v1.19.2, postgres/redis digests, docker/dockerfile syntax digest pin
#188	non-major repo tooling in app/, docs/, www/
#182	root pnpm-lock.yaml + uv.lock refresh
#183	backend/uv.lock refresh
#184	terraform provider locks — already landed via #180, nothing left to carry

pnpm-lock.yaml was regenerated with just lockfile on top of #182's maintenance refresh so both the refresh and #188's bumps are in.

Second commit adds the actions language to the CodeQL matrix: actionlint and zizmor lint workflow syntax and permissions, and the actions language adds dataflow queries over the same files. Watch the new CodeQL (actions) job — first run, so it may surface pre-existing alerts.

Not included: #189 (repo-tooling major — Babel 8, Jest 30, pnpm 12, async-storage 3, RNTL 14). That is a migration, not a bump, and stays on its own branch.

Verified locally

• just check — pass
• just test — pass (root 43 + 105 policy checks, backend 1812, www 11, docs 161, app 1818)
• just pre-commit — pass (includes actionlint + zizmor on the changed workflow)