Add JavaScript SAST (CodeQL + eslint-plugin-security) to CI

The Java and C connectors use Infer for static analysis, but Infer has no JavaScript frontend. Add equivalent SAST coverage for the Node.js connector:

• CodeQL : deep taint/dataflow analysis (the Infer equivalent for JS).
• eslint-plugin-security : fast syntactic checks, added to the existing ESLint config

(Runs on every push and pull request, plus a weekly scheduled scan)