Add initial set of CodeQL rules and enable in CI

[djb15]

This PR adds an initial set of Wormhole specific CodeQL rules and enables them in CI. The CI jobs aren't run in this PR as they aren't yet in main. To see examples of CI running please take a look at the following:

• Success: Add initial set of CodeQL rules and enable in CI djb15/wormhole#461
• Success with rule violation: Demo: CodeQL alert rendering in PR view (do not merge) djb15/wormhole#462

This PR is extremely large, where most of the changes are the CodeQL rules themselves and almost all the files are new. I would encourage folks to focus on the actions workflow primarily.

The idea here is that new CodeQL rules will be added after violations are fixed going forwards. Using these rules we aim to add more consistency to the design patterns used without negatively impacting the developer experience.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.