Licence that converts to GPL after publication but is copyrighted prior to publication
Honestly, I doubt that copyright protection is of any use. The copyright on the code itself does not* extend to data produced using the code. Similarly, the copyright you would hold on the paper submission covers* that particular presentation of the data, but not the data itself. So as long as someone is physically able to view your data, I believe there is no legal avenue to prohibit them from doing their own analysis on their data.

However, for another researcher to take the output of your code and perform their own analysis in an attempt to scoop you, when they know you have your own paper doing the same analysis pending, is ethically very questionable. If it came to light that something like this happened, I think the academic community would strongly frown on it. That's a very strong incentive for any other researcher not to do this, and so I personally wouldn't worry about it.

Besides, if it does happen, the other researcher will have to cite your code anyway so you still get credit. This can actually be a good thing. I would recommend including in your code a notice of the form


  Please cite the following reference if you use the results of this code in a publication:
  
  [reference to paper or code]


(see this example from my own publication history) If you're worried about someone else abandoning all pretense of ethics and just using your results without citing them, rest assured that it is very difficult to pull that off, and it constitutes academic fraud, which is a career-ender if it's discovered.

And finally, as a practical matter, you have a very large head start on anyone else who might want to publish an analysis of the outcome of your code. Don't underestimate the time and effort it takes for someone else to go through your code in enough detail to learn what it does and figure out how to use it enough to generate original results, and then to write and submit a paper and have it reviewed, typeset, and published.

One more point worth mentioning:


  So I'd be interested also in what is considered good practice when you are in the situation of wanting to share data and code while an article is being peer reviewed, but not wanting to lose your right of first publication.


You don't have a right of first publication. Not legally, anyway. If you want to ensure that you are the first one to have an opportunity to publish a paper based on some result, the standard practice is to keep the result private until you are close to publishing the paper yourself. But keep in mind that "publishing" in this context doesn't have to be peer reviewed. For instance, in physics it's very common to put a paper on arXiv before submitting it to a journal. That establishes the authors' claim to the result before it enters the peer review process.

*informed layperson speculation; see a lawyer for a definitive statement