Update GitHub Actions workflows

- CodeQL: scan Actions workflows too, switch to build-mode none matrix, drop autobuild
- container: attach build provenance and SBOM to the image
- add timeout-minutes to all jobs

.github/workflows/container.yml

@@ -15,6 +15,7 @@ jobs:
   build-and-push-image:
     name: Build and push container image
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     permissions:
       contents: read
       packages: write
@@ -47,3 +48,5 @@ jobs:
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          provenance: true
+          sbom: true