CodeQL analysis workflow should be able to add comments on PRs originating from forks

See https://github.com/Framework-R-D/phlex/pull/117#discussion_r2538422702 for context.

The Phlex repository now has a suitable secret `WORKFLOW_PAT` that should be used in the appropriate place instead of `GITHUB_TOKEN`