CI: Configure Python analysis

[henrymercer]

While we're here, simplify the config a bit and add build modes.

Risk assessment

For internal use only. Please select the risk level of this change:

• Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Consider adding a changelog entry for this change.
• Confirm the readme and docs have been updated if necessary.

[Copilot]

Pull Request Overview

This PR configures Python analysis for CodeQL and simplifies the CI configuration by consolidating multiple analysis jobs into a single matrix-based job.

• Adds Python language analysis alongside existing Actions analysis
• Consolidates separate analyze-actions job into a matrix-based analyze-other job
• Replaces external config files with inline configuration

Reviewed Changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/codeql.yml	Updates JavaScript config file reference, consolidates Actions and Python analysis into matrix job with inline config
.github/codeql/codeql-actions-config.yml	File removed as part of config consolidation

[Copilot]

[nitpick] The fail-fast: false should be placed before the matrix definition for better readability and to follow GitHub Actions convention of placing strategy-level options before matrix definitions.

Suggested change

	matrix:
	include:
	- language: actions
	build-mode: none
	- language: python
	build-mode: none
	fail-fast: false
	fail-fast: false
	matrix:
	include:
	- language: actions
	build-mode: none
	- language: python
	build-mode: none

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[mbg]

LGTM with one suggestion for filtering out the Python test file

[mbg]

IMHO we should keep this and make it part of the matrix. Then we can have a Python config that filters out the test file. We could do the same with config in the matrix as well.

[henrymercer]

I think since we don't yet have anything that needs to be language specific, it might be more readable to have a single config embedded into the workflow file. I've pushed a commit to add that.

[mbg]

One comment + suggestion about the readability of the condition for the JS analysis results upload.