chore(ci): Add code scanning & fix dependabot failures (apache#1505)

Author: dpogue

.github/workflows/ci.yml

@@ -17,7 +17,13 @@
 
 name: Node CI
 
-on: [push, pull_request]
+on:
+  push:
+    branches-ignore:
+      - 'dependabot/**'
+  pull_request:
+    branches:
+      - '*'
 
 jobs:
   darwin:
@@ -41,13 +47,32 @@ jobs:
           node --version
           npm --version
 
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: javascript
+          queries: security-and-quality
+          config: |
+            paths-ignore:
+              - coverage
+              - node_modules
+              - templates/project/www/cordova.js
+
       - name: npm install and test
         run: |
           npm i -g ios-deploy
           npm cit
         env:
           CI: true
 
+      - uses: github/codeql-action/analyze@v3
+
+      - uses: codecov/codecov-action@v4
+        if: success()
+        with:
+          name: ${{ runner.os }} node.js ${{ matrix.node-version }} (darwin)
+          token: ${{ secrets.CORDOVA_CODECOV_TOKEN }}
+          fail_ci_if_error: false
+
   non-darwin:
     name: NodeJS ${{ matrix.node-version }} on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
@@ -69,10 +94,29 @@ jobs:
           node --version
           npm --version
 
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: javascript
+          queries: security-and-quality
+          config: |
+            paths-ignore:
+              - coverage
+              - node_modules
+              - templates/project/www/cordova.js
+
       - name: npm install and test
         run: |
           npm ci
           npm run lint
           npm run unit-tests
         env:
           CI: true
+
+      - uses: github/codeql-action/analyze@v3
+
+      - uses: codecov/codecov-action@v4
+        if: success()
+        with:
+          name: ${{ runner.os }} node.js ${{ matrix.node-version }} (non-darwin)
+          token: ${{ secrets.CORDOVA_CODECOV_TOKEN }}
+          fail_ci_if_error: false

.github/workflows/release-audit.yml

@@ -17,7 +17,13 @@
 
 name: Release Auditing
 
-on: [push, pull_request]
+on:
+  push:
+    branches-ignore:
+      - 'dependabot/**'
+  pull_request:
+    branches:
+      - '*'
 
 jobs:
   test: