fix(ci): target master branch in security.yml and codeql.yml

Both workflow files referenced 'main' branch for push/PR triggers, but
the repo default branch is 'master'. This caused security scanning and
CodeQL analysis to never trigger on pushes to the default branch.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/workflows/codeql.yml

@@ -2,9 +2,9 @@ name: CodeQL Analysis
 
 on:
   push:
-    branches: [main]
+    branches: [master]
   pull_request:
-    branches: [main]
+    branches: [master]
   schedule:
     # Run weekly on Monday at 06:17 UTC — off-peak to avoid :00/:30 congestion
     - cron: "17 6 * * 1"

.github/workflows/security.yml

@@ -2,9 +2,9 @@ name: Security Scanning
 
 on:
   push:
-    branches: [main]
+    branches: [master]
   pull_request:
-    branches: [main]
+    branches: [master]
   schedule:
     # Run daily at 05:43 UTC — catch new CVEs early
     - cron: "43 5 * * *"