fix(ci): restore CodeQL manual build mode for Go

Go's CodeQL extractor does not support build-mode: none. Restore the
manual build mode with setup-go and explicit go build step, matching the
original codeql.yml configuration.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: cpcloud

.github/workflows/security.yml

@@ -61,16 +61,25 @@ jobs:
       cancel-in-progress: ${{ github.event_name == 'pull_request' }}
     permissions:
       security-events: write
+    env:
+      CGO_ENABLED: "0"
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           persist-credentials: false
 
+      - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
+        with:
+          go-version: "1.25"
+
       - name: Initialize CodeQL
         uses: github/codeql-action/init@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3
         with:
           languages: go
-          build-mode: none
+          build-mode: manual
+
+      - name: Build
+        run: go build ./...
 
       - name: Perform CodeQL analysis
         uses: github/codeql-action/analyze@9e907b5e64f6b83e7804b09294d44122997950d6 # v4.32.3