Add automated security + house-style gates (CodeQL, Semgrep, conventions, Copilot)

[aidangarske]

Description

Tightens automated review to security and the documented house conventions, deterministically where possible.

CodeQL (.github/workflows/codeql.yml)

• C analysis with the security-extended query suite only (no security-and-quality maintainability nits like "poorly documented function").

Semgrep security rules (.github/semgrep-rules.yml, semgrep.yml) — deterministic, fail the build, currently 0 hits:

• No dynamic allocation (malloc/XMALLOC/... in src/ and include/wolfcose/)
• No unbounded libc (strcpy/sprintf/gets/...)
• No non-constant-time memcmp/XMEMCMP in src/ (use ConstantCompare for secrets)

House-style check (scripts/check_house_style.sh, house-style.yml) — repo-wide conventions, the right tool (grep) for comment/text style:

• No goto anywhere
• C-style comments only (no //)
• Section banners use the /* ----- ... ----- */ style (no =====/#####/*****)
• != NULL null-checks, no tabs, no trailing whitespace
• Fixed the only two deviations found (two ===== banners in tests/test_cose.c).

Copilot review instructions (.github/copilot-instructions.md)

• Steers Copilot to security/correctness, skips style/comment-density/"too long" nits, never suggests dynamic allocation. (Addressed Copilot's own review: uses wolfCose_ForceZero, not bare ForceZero.)

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.