ci: better filter workflow runs

Signed-off-by: Seth Flynn <getchoo@tuta.io>

.github/workflows/codeql.yml

@@ -1,6 +1,39 @@
 name: "CodeQL Code Scanning"
 
-on: [push, pull_request, workflow_dispatch]
+on:
+  push:
+    # NOTE: `!` doesn't work with `paths-ignore` :(
+    # So we a catch-all glob instead
+    # https://github.com/orgs/community/discussions/25369#discussioncomment-3247674
+    paths:
+      - "**"
+      - "!.github/**"
+      - ".github/workflows/codeql.yml"
+      - "!flatpak/"
+      - "!nix/"
+      - "!scripts/"
+
+      - "!.git*"
+      - "!.envrc"
+      - "!**.md"
+      - "COPYING.md"
+      - "!renovate.json"
+  pull_request:
+    # See above
+    paths:
+      - "**"
+      - "!.github/**"
+      - ".github/workflows/codeql.yml"
+      - "!flatpak/"
+      - "!nix/"
+      - "!scripts/"
+
+      - "!.git*"
+      - "!.envrc"
+      - "!**.md"
+      - "COPYING.md"
+      - "!renovate.json"
+  workflow_dispatch:
 
 jobs:
   CodeQL: