bump versions, raise coverage requirement and implement codeql (#253)

codeql was getting triggered even without the workflow.

bumping versions and raising coverage requirement to 98.06%