GitHub security workshop: Add a custom CodeQL query exercise

[softchris]

Goal

Teach how CodeQL can enforce an organization-specific security rule that is not represented by the default query suite.

Scope

Choose one simple, app-relevant Python pattern and provide a small starter query that learners can understand and extend. Document the tested execution path using supported CodeQL tooling, then show how a query pack or configuration is incorporated into repository analysis.

Acceptance criteria

• The target pattern is security-relevant, specific to the pets app, and has a deterministic positive and negative example.
• The exercise explains the query metadata, imports, predicates, result selection, and help text at an introductory level.
• A pinned/tested CodeQL CLI or supported hosted workflow is documented.
• Learners run the query and see exactly the expected result set.
• The custom query is packaged and referenced using a currently supported CodeQL configuration.
• A subsequent repository analysis reports the custom result with recognizable metadata.
• Maintainer validation detects query compilation failures and result drift.
• The exercise documents feature or plan constraints and an observation-only fallback.

[scubaninja]

Backlog review priority: deferred. Tagging @scubaninja for visibility and follow-up.