fix(ci): add actions:read permission for CodeQL (#29)

* feat(ci): add GitHub Actions workflow — build, package, release

Replaces AppVeyor. Builds CLI + GUI + combined zip + NuGet on every
push to master. On tag push (v*), creates GitHub Release with all
artifacts attached.

* fix(ci): build on branch push, release only on PR merge to master

- Build + package on push to master/feature/fix branches and PRs
- Release job only runs on merge to master (not every push)
- Auto-tags with version computed from git history

* fix(ci): install .NET 4.6.1 targeting pack for C++ test project

windows-2022 runner lacks the net461 reference assemblies needed by
the 244_ClrProtection.vcxproj test project.

* feat(ci): use NBGV for automatic versioning

Version computed by Nerdbank.GitVersioning (same as assembly version).
Release tag, GitHub Release name, and assembly version all match
automatically — no manual version management needed.

* fix(ci): update dependabot config for private fork

- Change reviewer from mkaring to mcpolo99
- Change schedule from daily to weekly
- Add github-actions ecosystem monitoring
- Add open-pull-requests-limit (10 nuget, 5 actions)

* fix(ci): update CodeQL workflow — windows-2019 and codeql v1 are deprecated

- Change runner from windows-2019 to windows-2022
- Update codeql-action from v1 to v3
- Update checkout from v2 to v4

* fix(ci): replace CodeQL autobuild with custom build steps

Autobuild fails because the C++ test project needs .NET 4.6.1 targeting
pack. Use the same MSBuild + targeting pack install as the main CI workflow.

* fix(ci): add actions:read permission for CodeQL SARIF upload

---------

Co-authored-by: RandomCrocodile <mawi@polosab.com>

Author: mcpolo99

.github/workflows/codeql-analysis.yml

@@ -12,6 +12,7 @@ permissions:
   contents: read
   security-events: write
   pull-requests: read
+  actions: read
 
 jobs:
   analyze: