fix: stop the recurring CodeQL OutOfMemoryError

[Frisch12]

Problem

Analyze (java-kotlin) fails intermittently, most recently on main in
run 33512523694
after 1h20m, and on 2026-08-31 in
run 33368076297.
Same task both times:

> Task :quicktype-plugin:compileTestKotlin FAILED
e: java.lang.OutOfMemoryError: Java heap space
> Not enough memory to run compilation. Try to increase it via 'gradle.properties':
  kotlin.daemon.jvmargs=-Xmx<size>

Since the job is a required status check, every occurrence blocks merges.

Root cause

Neither org.gradle.jvmargs nor kotlin.daemon.jvmargs was set anywhere.
Gradle's daemon therefore defaulted to -Xmx512m, and the Kotlin daemon
inherits -Xmx from it.
That is not enough for the Kotlin compiler to initialise, even for the ~450
lines of Kotlin in this repository.

It looked flaky because it is really a cache-hit/cache-miss difference: the
regular CI restores ~/.gradle via setup-gradle, so with
org.gradle.caching=true the compile tasks come from the build cache and never
run. CodeQL builds uncached and hits the ceiling every time.

Changes

• gradle.properties (root and examples/) — set org.gradle.jvmargs and
  kotlin.daemon.jvmargs. Fixing it here rather than in one workflow keeps it
  true for CI on a cache miss and for local builds too.

• codeql.yml — build-mode: autobuild → manual with an explicit
  ./gradlew testClasses --no-daemon --no-build-cache -S and a pinned JDK 17
  (the project toolchain; settings.gradle has no toolchain resolver, so Gradle
  cannot provision one itself).

  --no-build-cache is deliberate and load-bearing: a compile task served from
  the cache invokes no compiler, the tracer sees nothing, and CodeQL would
  report a green run over an empty database. GitHub names Gradle caching as
  a cause of "No source code was seen during the build".
  For the same reason setup-gradle is intentionally not used here.

  The task list is what autobuild already compiled, so the scanned scope is
  unchanged.

• Timeout for java-kotlin from 360 to 60 minutes. A healthy run takes ~7.

How to verify

Beyond the checks going green, the analysis must not come back empty:

gh api "/repos/freefair/gradle-plugins/code-scanning/analyses?per_page=5" \
  --jq '.[] | {created_at, ref, results_count, rules_count}'

A healthy analysis on main reports rules_count: 240 / results_count: 54.
The failed run uploaded 0 / 0. If this PR's analysis does not report ~240
rules, the build mode is misconfigured and this should not be merged.

Locally ./gradlew assemble and ./gradlew check both pass with the new
settings.