CodeQL: Add `actions: write` permission to support TRAP cache cleanup

[henrymercer]

This PR adds the actions: write permission to the CodeQL workflow so that the CodeQL workflow can automatically cleanup unused CodeQL TRAP caches.

While we're here, we also add a step name for the manual build commands step, so it's more clear what is going on when this step is skipped.