chore(ci): widen CodeQL PR guard

Runs the PR CodeQL security guard as high-confidence high/critical security coverage and adds the initial plugin/package-contract quality guard.

.github/codeql/codeql-actions-critical-security.yml

@@ -1,5 +1,18 @@
 name: openclaw-codeql-actions-critical-security
 
+disable-default-queries: true
+
+queries:
+  - uses: security-extended
+
+query-filters:
+  - include:
+      precision:
+        - high
+        - very-high
+      tags contain: security
+      security-severity: /([7-9]|10)\.(\d)+/
+
 paths:
   - .github/actions
   - .github/workflows