ci(codeql): skip the tests directory (#1557)

CodeQL scans `tests/`, which only runs in CI and the e2e docker stack.
That is where the open `py/full-ssrf` (critical) and the two
`py/reflective-xss` alerts come from, all in the e2e mock server, plus
four `py/incomplete-url-substring-sanitization` alerts on URL asserts.
None of them can reach a running instance.

This adds `.github/codeql/codeql-config.yml` with `paths-ignore: tests`
and points the init step at it. It closes those seven and hides nothing
in `shelfmark/` or the frontend. The rest of the open alerts are
unchanged.

@calibrain I know I have ability to merge this, but wanted you to be the
one for this. It clears the test alerts and leaves the rest, and
prevents you from having to clear them manually. Just a little QoL.

.github/codeql/codeql-config.yml

@@ -0,0 +1,6 @@
+name: Shelfmark CodeQL configuration
+
+# Test code only runs in CI and the e2e docker stack (mock servers, URL asserts), so its
+# findings are noise. Skipping it drops those alerts without hiding anything in the app.
+paths-ignore:
+  - tests