Update CodeQL workflow and configuration, fix found bugs

[Jake Bailey (jakebailey)]

The config we had here was pretty old and contained some cruft that is no longer recommended by https://github.com/github/codeql-action.

Update it to be based on their new example config (with changes), and ignore src/lib (which does not contain code).

Love this.

Thank them, I didn't make this 😄

Still loving it, no matter who added it. I always have to look up the Cron syntax.

I just use https://crontab.guru/

Why does the minute come first and why are hours 0-based but dates are 1-based? That's confusing as hell.
edit: Wait, 24-hour time uses zero-based hours. Still confusing that the minutes come first, though.

Should we add the scripts directory?

Maybe, though that's pure dev dependency; I actually considered ignoring tests too but opted not to.

Added it and the gulpfile; we'll see if it breaks.

Looks like quite a few things showed up; the ones about uncontrolled user input are probably ignorable since that's what those scripts intend to do anyway. The rest are sort of interesting.

One of these actually looks like a bug; the localization script only replaced the first ] when it should have replaced all of them. Of course, what we should do is not produce XML via string templates, but, that's another story. Maybe after modules as my stack includes a build change on that front.

I made some changes to fix the things that are now found. The only major change is the diagnostic message change, where I've switched us to using JSON.stringify instead, which appears to have no performance difference.