chore(deps): bump github/codeql-action to v4.39.3 in every workflow (#183)

Supersedes #173, #174 and #175: each bumped one of init, autobuild and
analyze, and CodeQL's Analyze fails while they differ. Scorecard's
upload-sarif moves too, and Dependabot now groups them in one PR.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: feversoul

.github/dependabot.yml

@@ -19,6 +19,11 @@ updates:
     directory: "/"
     schedule:
       interval: weekly
+    groups:
+      # init, autobuild, analyze and upload-sarif must share one version: a
+      # PR bumping one alone fails CodeQL's Analyze job.
+      codeql-action:
+        patterns: ["github/codeql-action*"]
 
   # Base images are pinned by digest; this keeps the digests current.
   - package-ecosystem: docker

.github/workflows/codeql.yml

@@ -26,15 +26,15 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
         with:
           languages: javascript-typescript
           queries: security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        uses: github/codeql-action/autobuild@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
         with:
           category: "/language:javascript-typescript"

.github/workflows/scorecard.yml

@@ -29,6 +29,6 @@ jobs:
           results_format: sarif
           publish_results: true
 
-      - uses: github/codeql-action/upload-sarif@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
+      - uses: github/codeql-action/upload-sarif@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
         with:
           sarif_file: results.sarif