Enforce ruff lint / format in CI + pre-commit, clear the baseline, fix CodeQL findings

Enforce ruff lint / format in CI + pre-commit, clear the baseline, fix CodeQL findings #658