P1: Add CodeQL workflow + dependabot.yml for org-wide security hygiene

[yeongseon]

Problem

No CodeQL static analysis workflow and no dependabot.yml in the .github repo. Dependency vulnerabilities and code security issues go undetected across all cubrid-lab repos.

Fix

1. Add reusable CodeQL workflow (.github/workflows/codeql.yml) with workflow_call trigger — reusable from all repos
2. Add dependabot.yml at .github/dependabot.yml covering:
   • pip ecosystem (Python deps)
   • github-actions ecosystem (action version updates)
3. Schedule: CodeQL on push + weekly; dependabot weekly

Acceptance Criteria

• codeql.yml reusable workflow exists (workflow_call trigger)
• dependabot.yml covers pip and github-actions ecosystems
• Both follow GitHub-recommended defaults (auto-cancel, proper permissions)
• Can be called from pycubrid repo (tested or verified config)

Oracle design review: Not required — standard security patterns.