Re-enable codeql analysis

[imjasonh]

These were dropped in #364 and I don't remember why. The result is that code scanning alerts have been disabled since May: https://github.com/google/ko/security/code-scanning

[codecov-commenter]

Codecov Report

Merging #457 (a233982) into main (688ca47) will not change coverage.
The diff coverage is n/a.

❗ Current head a233982 differs from pull request most recent head 757233c. Consider uploading reports for the commit 757233c to get more accurate results

@@           Coverage Diff           @@
##             main     #457   +/-   ##
=======================================
  Coverage   53.25%   53.25%           
=======================================
  Files          36       36           
  Lines        1842     1842           
=======================================
  Hits          981      981           
  Misses        710      710           
  Partials      151      151           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 688ca47...757233c. Read the comment docs.

[imjasonh]

This seems to have found two genuine issues.