CI: more filters, update CodeQL (#1540)

* CI: fix and more greedy filtering

* CI: only run lint if *.py changed

* CI: only run CodeQL if supported file changed

* CI: fix unittests still triggering for build.yml

* CI: update CodeQL action

* CI: trigger codeql when changing the workflow

.github/workflows/unittests.yml

@@ -5,17 +5,23 @@ name: unittests
 
 on:
   push:
-    paths-ignore:
-      - 'docs/**'
-      - 'setup.py'
-      - '*.iss'
-      - '.gitignore'
+    paths:
+      - '**'
+      - '!docs/**'
+      - '!setup.py'
+      - '!*.iss'
+      - '!.gitignore'
+      - '!.github/workflows/**'
+      - '.github/workflows/unittests.yml'
   pull_request:
-    paths-ignore:
-      - 'docs/**'
-      - 'setup.py'
-      - '*.iss'
-      - '.gitignore'
+    paths:
+      - '**'
+      - '!docs/**'
+      - '!setup.py'
+      - '!*.iss'
+      - '!.gitignore'
+      - '!.github/workflows/**'
+      - '.github/workflows/unittests.yml'
 
 jobs:
   build: