CI updates and bump deps (#27)

* add deps scan workflow

* Create codeql.yml

* remove codeql

* add upload feature

* add output file

* update ci jobs

* update deps

* minor ci tweaks

* remove build test

* combine ci jobs

* require security scan

* more ci concurrency

* add SBOM to release flow