chore: SEC25-116 Add Psalm PHP static analysis and CI/CD integration

[Glenn-Ewing]

Updates CodeQL workflow to use official Psalm GitHub Action template.

• Updates workflow to use docker://ghcr.io/psalm/psalm-github-actions
• Adds separate quality and security scan jobs
• Updates cron schedule to run every 2 weeks (1st and 15th)
• Updates action versions (checkout@v6, codeql-action@v4)

Implements SEC25-116

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[Copilot]

Pull request overview

This PR modernizes the CodeQL workflow to use the official Psalm GitHub Action via Docker, splitting analysis into separate quality and security scan jobs. It updates the cron schedule to run biweekly instead of weekly and upgrades action versions.

Changes:

• Replaced manual Psalm setup with official Docker-based ghcr.io/psalm/psalm-github-actions action
• Split workflow into separate quality and security jobs for better organization
• Updated cron schedule from weekly to biweekly (1st and 15th of each month)
• Upgraded actions to checkout@v6 and codeql-action/upload-sarif@v4

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.