chore(ci): scan the TypeScript client with CodeQL

[Anuj-72]

Follow-up 2 from #35 / #145: CodeQL's language matrix was [python, go], so the VS Code extension's TypeScript was the one shipped tree nothing scanned.

What changed

• .github/workflows/codeql.yml — javascript-typescript joins the matrix. No build step needed (the JS extractor reads source directly), and both Go steps already carry if: matrix.language == 'go', so the new leg skips them. category and concurrency are already per-language, so nothing else needed touching.
• extensions/vscode/src/ui/chatView.ts — the first finding the new leg reports is ours. The webview's CSP nonce came from Math.random() (the shape every VS Code webview sample uses), which trips js/insecure-randomness in the security-and-quality pack. Now randomBytes(16).toString('hex'), keeping the 32-character shape the CSP grammar wants.

Not a live hole, to be clear about severity: renderHtml interpolates nothing untrusted and media/chat.js writes through textContent, so a guessed nonce had no injection point to unlock. Fixed because a security token shouldn't come from a non-cryptographic PRNG regardless.

Verified

Rebased on current dev (33f57e2), which already carries 0c2e02c — follow-up 1 from that same list. That commit touches chatView.ts too, but at the proxyUrl default (~line 163), nowhere near getNonce (~line 740); no conflict.

extensions/vscode: tsc --noEmit clean, eslint src test clean, 133 tests passing (10 files), production bundle builds. codeql.yml parses as YAML with the matrix reading ['python', 'go', 'javascript-typescript'].

The workflow change itself can only really be proven by running it — the extension's own CI job doesn't cover the CodeQL leg, so the new matrix entry gets its first real exercise on this PR.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.