ci(codeql): upgrade github/codeql-action to v4.38.0 (#54)

[vianbas]

Summary

Upgrades github/codeql-action (init, autobuild, analyze) in .github/workflows/codeql.yml from v3.36.2 to v4.38.0. All three steps change together in one PR.

Closes #54

Supersedes #28, #35, #36 and #37 (Dependabot's split v4.36.2 bumps).

Why:

• CodeQL upload fails on PR chore(ci): run Dependabot monthly with grouped minor/patch updates (#52) #53. The analysis finishes, then stops at "Uploading results" with no error. It failed on two attempts, and a third rerun never started. The same workflow passed on main on 2026-09-11, with an identical runner (2.337.0) and image (ubuntu-24.04 20260907.300.1).
• v3 is being retired. Every run carries the annotation "CodeQL Action v3 will be deprecated in December 2026". The v3 actions target Node.js 20, which GitHub removes from runners on 2026-09-23; v4 runs on Node.js 24.

Architecture summary

• Only the three uses: pins in .github/workflows/codeql.yml change. The workflow triggers, permissions and matrix stay the same.
• The pin is commit b96794f015dfd88f77b49b1c93e0fa7110f94c63. I verified that the v4.38.0 annotated tag in github/codeql-action resolves to that commit, and v4.38.0 is the latest non-prerelease v4 release (2026-09-09).
• Nothing in the v4 changelog affects this config. v4 runs on Node.js 24 and needs CodeQL bundle ≥ 2.19.4; the runner uses 2.27.0.

Security considerations

• The action stays pinned by full commit SHA, with the version recorded in a comment.
• permissions stays at contents: read and security-events: write.
• Keeps code scanning uploads working on a supported action version.

Testing evidence

• The YAML parses, and all three CodeQL steps resolve to b96794f.
• git diff --check is clean.
• No other codeql-action references remain in the repo.
• The CodeQL check on this PR is the real test: both languages need to pass and upload results.

Known limitations

• chore(ci): run Dependabot monthly with grouped minor/patch updates (#52) #53's CodeQL check still shows the failed v3 run. Once this merges, chore(ci): run Dependabot monthly with grouped minor/patch updates (#52) #53's branch gets updated with main so CodeQL runs again on v4.

Follow-up issues

• After merge: close chore(ci): bump github/codeql-action from 3.36.2 to 4.36.2 #28, chore(ci): bump github/codeql-action/autobuild from 3.36.2 to 4.36.2 #35, chore(ci): bump github/codeql-action/init from 3.36.2 to 4.36.2 #36 and chore(ci): bump github/codeql-action/analyze from 3.36.2 to 4.36.2 #37 as superseded, and confirm CodeQL passes on main and on chore(ci): run Dependabot monthly with grouped minor/patch updates (#52) #53.

Checklist

• Branch is not main; this PR targets main.
• Conventional commit message.
• git diff --check is clean.
• No secrets, real/personal data, or proprietary references.
• Contracts updated first where applicable: n/a.
• Docs updated to match the change: n/a.