ci(codeql): enable security-extended suite and align ignore paths (#22245)

Enable the security-extended query suite for C/C++ so the scan includes taint-based memory-safety queries (cpp/uncontrolled-arithmetic, cpp/overflow-buffer, cpp/static-buffer-overflow, etc.) that are not part of the default suite. Align paths-ignore with the patterns excluded from Coverity so vendored and external dependencies stop producing alerts we do not own: - build/** build artifacts and CMake _deps (protobuf, absl, ...) - externaldeps/** bundled third-party sources - **/vendored/** all vendored libraries (libjudy, sqlite3, json, libsensors, ...) in one catch-all glob Also remove the stale httpd/h2o entry; that directory no longer exists.