Add a diagnostics job to the CodeQL workflow

The CodeQL workflow already had a harden-runner task, but it's good to
agree everywhere with the changes we made to the build.yml workflow in
cisagov/skeleton-generic#144.

Author: jsf9k

.github/workflows/codeql-analysis.yml

@@ -20,8 +20,27 @@ on:
     - cron: '0 2 * * 6'
 
 jobs:
+  diagnostics:
+    name: Run diagnostics
+    runs-on: ubuntu-latest
+    steps:
+      # Note that a duplicate of this step must be added at the top of
+      # each job.
+      - id: harden-runner
+        name: Harden the runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+      - id: github-status
+        name: Check GitHub status
+        uses: crazy-max/ghaction-github-status@v3
+      - id: dump-context
+        name: Dump context
+        uses: crazy-max/ghaction-dump-context@v2
   analyze:
     name: Analyze
+    needs:
+      - diagnostics
     runs-on: ubuntu-latest
     permissions:
       # required for all workflows