ci: add CodeQL, pre-commit, and labeler workflows

- CodeQL: Python security analysis on push/PR + weekly schedule
- Pre-commit: ruff lint/format checks on push/PR
- Labeler: auto-label PRs based on changed files

.github/workflows/labeler.yml

@@ -0,0 +1,17 @@
+name: Labeler
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  label:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/labeler@v5
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}