ci(repo): add CodeQL scanning

.github/workflows/code-scanning.yml

@@ -0,0 +1,34 @@
+name: "Code Scanning"
+
+on:
+  push:
+    branches: [main, alpha]
+  pull_request:
+    branches: [main, alpha]
+    paths-ignore:
+      - "**/*.md"
+
+jobs:
+  CodeQL-Build:
+    runs-on: ubuntu-latest
+
+    permissions:
+      # required for all workflows
+      security-events: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: "typescript, javascript"
+          config: |
+            paths-ignore:
+              - '**/__tests__'
+              - '**/test'
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3

README.md

@@ -2,7 +2,9 @@
 
 [![NPM](https://nodei.co/npm/@camunda8/sdk.png)](https://www.npmjs.com/package/@camunda8/sdk)
 
-This is the official Camunda 8 JavaScript SDK. It is written in TypeScript and runs on Node.js. See details on why [this is not in a web browser](https://github.com/camunda/camunda-8-js-sdk/issues/79)).
+[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
+
+This is the official Camunda 8 JavaScript SDK. It is written in TypeScript and runs on Node.js. See why [this does not run in a web browser](https://github.com/camunda/camunda-8-js-sdk/issues/79).
 
 ## What does "supported" mean?