Migrate CodeQL to advanced setup for faster CI

[zeevdr]

Description

Mirrors decree#183. Switching from CodeQL default-setup to advanced-setup enables paths-ignore for generated code and dep caching across runs, expected to save ~1 min on PR CI.

Acceptance criteria

• Disable default-setup in repo settings (Code scanning → CodeQL → Switch to advanced)
• Add .github/workflows/codeql.yml with explicit Analyze jobs for python / actions
• Add paths-ignore for generated proto code under sdk/src/opendecree/_generated/ (whatever the path is)
• Cache pip / venv across CodeQL runs
• Verify advanced-setup flags equivalent findings vs default-setup on the same commit
• Update main branch protection if the required-status-check name changes

Related

• decree#183 (parent / decree repo migration)