Enable code scanning (CodeQL / Scorecard) for coverage parity

[fro-bot]

Context

Linked from the Daily Org Oversight Report — 2026-03-09.

Summary

`fro-bot/fro-bot.github.io` currently has no code scanning analysis configured. Other repos in the org (`.github`, `agent`) run both CodeQL and OpenSSF Scorecard scans.

Recommended Actions

1. Add a CodeQL workflow — create `.github/workflows/codeql.yml` with analysis appropriate for the repo's language(s)
2. Add a Scorecard workflow — create `.github/workflows/scorecard.yml` to run OpenSSF Scorecard checks
3. Enable GitHub code scanning alerts in the repository security settings

This brings the repo into coverage parity with the rest of the org.

References

• GitHub CodeQL setup docs
• OpenSSF Scorecard GitHub Action

/cc @fro-bot