Add CodeQL, Codecov, Codacy, Renovate and actionlint

The onboarding added renovate.json at the root, which Renovate reads
before .github/renovate.json5; the root file goes, so the schedule, the
release age and the rules_cc approval apply.

zizmor found that the pinned commit was not the one the v4 comment
named; the pin is the commit of v4.39.3 and says so.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

rules_cc takes llvm-profdata from BAZEL_LLVM_PROFDATA; GCOV left the
coverage script without it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- CodeQL analyses the workflows and the C++ sources, without a build,
  with the security-extended queries, on every push to main, every pull
  request and once a week.
- A coverage job runs the tests under Clang's own coverage on Linux and
  a job of its own uploads the lcov report to Codecov through OIDC.
- .codacy.yml leaves out the output of Bazel and the rules_cc patch.
- Renovate proposes Bazel modules, Bazel itself and GitHub Actions once
  a week, a week after their release; rules_cc waits for approval on
  the dashboard, since its clang-cl patch has to be checked first.
- actionlint joins zizmor in Workflow Security.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Configure Renovate

Tazelish installs Tazel and chooses which version of it runs, for those
who use Tazel alone. This first part holds everything that needs no
download:

- Versions: MAJOR.SEMIMAJOR.MINOR.PATCH without leading zeros,
  unstable, nightly, and YYYY-MM-DD-unstable or -nightly with a date
  the calendar has.
- The command line, read by hand into a typed command: install, use
  and default with --force before or after the version, self
  update|remove|purge, and help with or without a command. A wrong
  command line ends with exit code 2.
- tazelish.txt and config.txt: the nearest tazelish.txt in the current
  folder or above it comes first, then $HOME/.tazelish/config.txt or
  %USERPROFILE%\.tazelish\config.txt. use and default refuse to write
  over a file that exists unless --force is given.

install and self download from static.tazel.net, which this build does
not do; they say so and end with exit code 1.

C++17 with fmt, tested with Catch3, built by Bazel (clang-cl on
Windows, with the rules_cc patch the Tala repository carries). The code
throws no exceptions and builds with warnings as errors; the tests
leave out -Wconversion, which the headers of Catch3 do not pass. CI
tests on Linux, macOS and Windows.