ci(codeql): upgrade github/codeql-action from v3 to v4

[vianbas]

Why

• CodeQL upload fails on PR chore(ci): run Dependabot monthly with grouped minor/patch updates (#52) #53. The "Perform CodeQL analysis" step finishes the analysis, then stops at "Uploading results" with no error. It failed on two attempts, and a third rerun never started. Nothing reached code scanning. The same workflow passed on main on 2026-09-11, with the same runner and image version.
• v3 is being retired. GitHub annotates every run with: "CodeQL Action v3 will be deprecated in December 2026". The v3 actions also target Node.js 20, which GitHub removes from runners on 2026-09-23; they already run forced onto Node.js 24.
• Dependabot's bump arrives split. It opens separate PRs (chore(ci): bump github/codeql-action from 3.36.2 to 4.36.2 #28, chore(ci): bump github/codeql-action/autobuild from 3.36.2 to 4.36.2 #35, chore(ci): bump github/codeql-action/init from 3.36.2 to 4.36.2 #36, chore(ci): bump github/codeql-action/analyze from 3.36.2 to 4.36.2 #37) for init, autobuild and analyze, and those fail CI individually. Dependabot's own pin, v4.36.2, is from June; the current v4 release is v4.38.0.

Scope

• In .github/workflows/codeql.yml, pin init, autobuild and analyze to v4.38.0, commit b96794f015dfd88f77b49b1c93e0fa7110f94c63. I verified that the v4.38.0 annotated tag in github/codeql-action resolves to that commit.
• Supersedes chore(ci): bump github/codeql-action from 3.36.2 to 4.36.2 #28, chore(ci): bump github/codeql-action/autobuild from 3.36.2 to 4.36.2 #35, chore(ci): bump github/codeql-action/init from 3.36.2 to 4.36.2 #36 and chore(ci): bump github/codeql-action/analyze from 3.36.2 to 4.36.2 #37.

Acceptance criteria

• CodeQL (Go and JavaScript/TypeScript) passes on the PR, and results upload to code scanning.
• After merge, CodeQL passes on main, and chore(ci): run Dependabot monthly with grouped minor/patch updates (#52) #53's CodeQL check passes once its branch is updated.