fix: add CodeQL barrier model for sanitizeForLog against log injection (#935)

sanitizeForLog() already strips CR, LF, and control characters from user
input before logging, but CodeQL did not recognize the custom sanitizer.
This caused false-positive log-injection alerts at every call site.

Add a CodeQL data extension model that marks the return value of
sanitizeForLog() as a barrier against log-injection taint, and a
codeql-config.yml that references it.

.github/codeql/codeql-config.yml

@@ -0,0 +1,2 @@
+data_extensions:
+  - .github/codeql/extensions/safeLog.model.yml

.github/codeql/extensions/safeLog.model.yml

@@ -0,0 +1,6 @@
+extensions:
+  - addsTo:
+      pack: codeql/javascript-all
+      extensible: barrierModel
+    data:
+      - ["backend/src/utils/safeLog", "Member[sanitizeForLog].ReturnValue", "log-injection"]

.github/workflows/codeql.yml

@@ -37,6 +37,7 @@ jobs:
         with:
           languages: ${{ matrix.language }}
           queries: security-extended
+          config-file: .github/codeql/codeql-config.yml
 
       - name: Autobuild
         uses: github/codeql-action/autobuild@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2