fix(ci): bump codeql-action/init and /analyze together to v4

[aparragithub]

Problem

.github/workflows/codeql.yml pins two sub-actions from the same github/codeql-action release:

• github/codeql-action/init@4187e74d05793876e9989daffde9c3e66b4acd07 # v3 (line 25)
• github/codeql-action/analyze@4187e74d05793876e9989daffde9c3e66b4acd07 # v3 (line 31)

Dependabot PR #65 bumps only init to v4.37.3, leaving analyze on v3. The CodeQL Action requires init and analyze to come from the same release, so merging #65 as-is would split the versions and break the CodeQL / analyze job — which is one of the checks that gates merges to main.

Scope

• Bump both init and analyze to e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 (v4.37.3) in a single change.
• Close chore(deps): bump github/codeql-action/init from 3.37.3 to 4.37.3 #65 as superseded.

Notes

v4.37.3 and v4 both resolve to commit e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81, and analyze/action.yml is present at that commit, so one pinned SHA covers both sub-actions.

The v4 line raises the minimum required CodeQL bundle to 2.19.4 and deprecates the undocumented CODEQL_ACTION_CLEANUP_TRAP_CACHES variable. This repository runs CodeQL on GitHub-hosted ubuntu-latest with the default bundle and does not set that variable, so neither applies.

Acceptance criteria

• init and analyze are pinned to the same commit SHA.
• The CodeQL and analyze checks pass on the PR.
• chore(deps): bump github/codeql-action/init from 3.37.3 to 4.37.3 #65 is closed.