* ci: add codeql quality profile input * ci: gate codeql quality profiles * ci: ignore spec files in codeql shard