Add CodeQL security scanning on pull requests. (apache#44404)

Apparently we only run codeql on main, but we could run it on PRs
as well. That's a good idea to test how it can look like.

.github/workflows/codeql-analysis.yml

@@ -19,6 +19,8 @@
 name: "CodeQL"
 
 on:  # yamllint disable-line rule:truthy
+  pull_request:
+    branches: ['main', 'v[0-9]+-[0-9]+-test', 'v[0-9]+-[0-9]+-stable']
   push:
     branches: [main]
   schedule: