Bump CodeQL actions together and group them in Dependabot (#7253, #7257, #7258) #7275

Problem

Dependabot opened three separate PRs to bump github/codeql-action from 4.38.0 to 4.39.x: #7253 (init), #7257 (autobuild) and #7258 (analyze). Each one fails CodeQL with:

Loaded a configuration file for version '4.38.0', but running version '4.39.1'. All steps in a workflow that use github/codeql-action must use the same version to work correctly.

All three steps live in .github/workflows/codeql-analysis.yml (lines ~51, 62, 76) and must be bumped together. Separate PRs can never go green, so this will happen again with every CodeQL release.

Tasks

• One PR that bumps all three github/codeql-action/* steps in codeql-analysis.yml to the same version (pinned SHA plus # vX.Y.Z comment, like today)
• In .github/dependabot.yml, add a group to the github-actions entry so future bumps arrive as one PR:

      groups:
        codeql:
          patterns:
            - "github/codeql-action*"

• Once merged, close build(deps): bump github/codeql-action/init from 4.38.0 to 4.39.1 #7253, build(deps): bump github/codeql-action/autobuild from 4.38.0 to 4.39.1 #7257 and build(deps): bump github/codeql-action/analyze from 4.38.0 to 4.39.1 #7258

Notes

• A good first issue: YAML-only, and CI tells you when it's right (the Analyze (ruby) and Analyze (javascript) checks).
• PRs that change .github/workflows/ from a fork run fine. A maintainer needs a token with the workflow scope to merge them.