ci(security): run CodeQL for pull requests and merge groups (#2388)