Add basic fuzz test + Enable codeql on GHA

[dereknola]

Proposed Changes

• Adds a basic fuzz test on the VerifyHash function
• Enables CodeQL static code analysis on our GitHub Actions

Types of Changes

New Unit test

Verification

CI Still green

Testing

Linked Issues

N/A

User-Facing Change

Further Comments

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 19.95%. Comparing base (6d076f4) to head (8011830).
Report is 13 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #12596      +/-   ##
==========================================
+ Coverage   19.90%   19.95%   +0.04%     
==========================================
  Files         184      183       -1     
  Lines       19265    19268       +3     
==========================================
+ Hits         3835     3844       +9     
+ Misses      14998    14990       -8     
- Partials      432      434       +2     

Flag	Coverage Δ
unittests	19.95% <ø> (+0.04%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

Report Summary

┌─────────────────────────────┬──────────┬─────────────────┬─────────┐
│           Target            │   Type   │ Vulnerabilities │ Secrets │
├─────────────────────────────┼──────────┼─────────────────┼─────────┤
│ bin/cni                     │ gobinary │        0        │    -    │
├─────────────────────────────┼──────────┼─────────────────┼─────────┤
│ bin/containerd-shim-runc-v2 │ gobinary │        0        │    -    │
├─────────────────────────────┼──────────┼─────────────────┼─────────┤
│ bin/k3s                     │ gobinary │        0        │    -    │
├─────────────────────────────┼──────────┼─────────────────┼─────────┤
│ bin/runc                    │ gobinary │        0        │    -    │
└─────────────────────────────┴──────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/v0.63/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


bin/k3s (gobinary)
==================
Total: 0 (HIGH: 0, CRITICAL: 0)


Suppressed Vulnerabilities (Total: 1)
=====================================
┌─────────────────────────────┬────────────────┬──────────┬──────────────┬─────────────────────────────┬──────────────────────┐
│           Library           │ Vulnerability  │ Severity │    Status    │          Statement          │        Source        │
├─────────────────────────────┼────────────────┼──────────┼──────────────┼─────────────────────────────┼──────────────────────┤
│ github.com/pion/interceptor │ CVE-2025-49140 │ HIGH     │ not_affected │ vulnerable_code_not_present │ rancher.openvex.json │
└─────────────────────────────┴────────────────┴──────────┴──────────────┴─────────────────────────────┴──────────────────────┘