chore: SEC25-120 Add Psalm PHP static analysis and CI/CD integration

[Glenn-Ewing]

Updates CodeQL workflow to use official Psalm GitHub Action template.

• Updates workflow to use docker://ghcr.io/psalm/psalm-github-actions
• Adds separate quality and security scan jobs
• Updates cron schedule to run every 2 weeks (1st and 15th)
• Updates action versions (checkout@v6, codeql-action@v4)

Implements SEC25-115

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[Copilot]

Pull request overview

This PR modernizes the CI/CD workflow by migrating from a custom Psalm execution setup to the official Psalm GitHub Actions docker image. The workflow now separates quality and security analysis into distinct jobs and adjusts the schedule to run bi-weekly instead of weekly.

Changes:

• Replaces manual Psalm setup and execution with the official Psalm GitHub Actions docker container
• Splits analysis into separate quality and security scan jobs running in parallel
• Updates cron schedule from weekly (Mondays) to bi-weekly (1st and 15th of each month)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.