gha: add CodeQL Analysis workflow

[thaJeztah]

copied from https://github.com/docker/cli/blob/88e6474350e644495a8009e9e1437332aa828a17/.github/workflows/codeql.yml

- What I did

- How I did it

- How to verify it

- Description for the changelog

- A picture of a cute animal (not mandatory but encouraged)

[thaJeztah]

Actually; let me change this to 1.21.5, so that we don't forget updating if we find/replace the other go versions

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[thaJeztah]

Ah, this probably requires some additional trickery to make it work;

2024/01/07 12:00:22 Warning: encountered errors extracting package `github.com/moby/moby/api/server/backend/build`:
2024/01/07 12:00:22   -: code in directory /home/runner/work/moby/moby/root/src/github.com/moby/moby/api/server/backend/build expects import "github.com/docker/docker/api/server/backend/build"
Error: 2024/01/07 12:00:22   /home/runner/work/moby/moby/root/src/github.com/moby/moby/api/server/backend/build/backend.go:48:27: cannot use s (variable of type *"github.com/moby/moby/vendor/google.golang.org/grpc".Server) as *"github.com/docker/docker/vendor/google.golang.org/grpc".Server value in argument to b.buildkit.RegisterGRPC

[crazy-max]

I think we should have a matrix to analyze both dockerd and docker-proxy. Mainly because "Autobuild" will not build any of them so would need to set https://github.com/github/codeql-action/blob/8516954d603e47049b34f3da4dfac83009fcd450/autobuild/action.yml#L9 to ./cmd/dockerd and ./cmd/docker-proxy using a matrix. Can be done in follow-up.

Edit: Actually it will run make so should be fine: https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages#autobuild-for-go