[Feat] Add CodeQL triage automation settings and UI

[roomote-roomote]

Opened on behalf of Matt Rubens. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

What changed

Adds Triage CodeQL Alerts as a first-class scheduled automation, mirrored from Dependabot triage end-to-end:

• Automations settings UI card (after Dependabot) with schedule Off/Daily/Weekly, Slack/Discord destination, and CodeQL/code-scanning remediation copy
• Web settings save/read and tRPC input schema wiring for codeqlTriage / codeql_triage
• Supporting types, DB projection, scheduled job, skill invocation, and suggestion prompt plumbing
• Public docs for the automation and GitHub code-scanning alert permissions
• Fast-path GitHub App manifest now requests security_events: read so newly created apps can list CodeQL / code-scanning alerts

Why this change was made

Teams already have Dependabot triage; CodeQL/code-scanning alerts need the same scan → prioritize → launch focused remediation tasks loop without manually opening follow-up work. Without code-scanning read access on the GitHub App, scheduled triage cannot retrieve alerts.

Impact

Admins can enable CodeQL triage on a schedule (or run now), choose a reporting channel, and get implement-changes follow-ups from open code-scanning/CodeQL alerts. The scan itself does not open PRs. New apps created through Roomote’s GitHub App manifest already include the permission needed for those alert reads.

Screenshots

[roomote-roomote]

No new code issues found. See task

• Medium: Add security_events: 'read' to the GitHub App manifest permissions in apps/web/src/trpc/commands/github/mutations.ts and update its manifest test. Fixed in 7296597.

_{Reviewed a6684cf}

[roomote-roomote]

Fixed the outstanding review item in 7296597:

• Added security_events: 'read' to the fast-path GitHub App manifest permissions
• Updated the manifest unit test to assert the new permission

New apps created through Roomote’s form will include code-scanning/CodeQL alert read access. Existing installed apps still need a permission upgrade on GitHub if they were created before this change.