ci(deps): group github/codeql-action Dependabot bumps (#2384, #2385, #2386)

Problem: Dependabot opened three separate PRs bumping one `github/codeql-action`
step each (init, autobuild, analyze). codeql-action now refuses to run unless
every step in the workflow is on the same version, so none of the three could
pass CI alone -- the init step writes a config file for its own version, and
the analyze step then refuses to load it under a different one.

Fix: group all `github/codeql-action/*` bumps under the github-actions
ecosystem, so Dependabot opens one PR that bumps every step together.

Author: JarryShaw

.github/dependabot.yml

@@ -26,3 +26,7 @@ updates:
     directory: "/" # Dependabot reads .github/workflows from the repository root
     schedule:
       interval: "weekly"
+    groups: # codeql-action now refuses to run unless every step in a workflow
+      codeql-action: # (init, autobuild, analyze) is on the same version (#2384-#2386)
+        patterns:
+          - "github/codeql-action/*"