chore(ci): use central CodeQL reusable workflow

[gmanal]

Description

Migrate this repo's CodeQL scan from repo-local workflow steps to the centrally maintained reusable workflow in NVIDIA/security-workflows.

The motivation is maintenance, not coverage: today every repo carries its own copy of the CodeQL action pins and query-suite configuration, so a CodeQL action bump or a suite change has to be replayed repo by repo.
Calling the shared workflow moves that to one place.

Changes

• .github/workflows/codeql.yml now calls NVIDIA/security-workflows/.github/workflows/sast-scan-codeql.yml, pinned to a reviewed 40-character commit SHA.
• Removes the repo-local checkout / codeql-action/init / codeql-action/analyze steps and their pins — the reusable workflow owns them.
• Moves permissions to the workflow level, since a caller must grant every permission the reusable workflow declares.

Behavior

Unchanged. Same triggers, concurrency group, action, language, build-mode, security-extended suite, and runners i.e.ubuntu-latest. runs-on and queries are passed explicitly rather than relying on the shared workflow's defaults, so this repo's coverage can't drift with upstream.

Notes for reviewers

• Check name changes from Analyze (python) to Analyze / CodeQL (python) — reusable-workflow jobs are namespaced by the calling job. Any branch-protection rule requiring the old name needs updating, otherwise it will read as a missing

Checklist

• New or existing tests cover these changes.
• The documentation is up to date with these changes.

[github-actions]

Doc Preview CI
🚀 View preview at https://nvidia.github.io/cuda-python/pr-preview/pr-2457/
https://nvidia.github.io/cuda-python/pr-preview/pr-2457/cuda-core/
https://nvidia.github.io/cuda-python/pr-preview/pr-2457/cuda-bindings/
https://nvidia.github.io/cuda-python/pr-preview/pr-2457/cuda-pathfinder/
Preview will be ready when the GitHub Pages deployment is complete.

[gmanal]

AI Report for old and new execution of workflow -

[gmanal]

@jrhemstad @kkraus14 @mdboom — would appreciate your take on this one.

The ask: does it make sense for cuda-python to get its CodeQL scan from a central reusable workflow instead of carrying its own copy?

Why I'm proposing it: this is a maintenance change, not a coverage change.
Today every NVIDIA repo running CodeQL carries its own codeql-action pins and query-suite config, so a CodeQL action bump or a suite change has to be replayed repo by repo. Calling NVIDIA/security-workflows moves that to one place. It's part of the GitHub-First security-scanning enablement work — same pattern already used for the Pulse secret scan.

The one thing that changes: the check name goes from Analyze (python) to Analyze / CodeQL (python), because reusable-workflow jobs are namespaced by the calling job.

Happy to hold this or to adjust the approach.
Note: I only have read access here, so I can't add reviewers through the sidebar — hence the mention.