build(deps): bump github/codeql-action to 4.39.1 (#2384, #2385, #2386) (#2391)

codeql-action now refuses to run unless every step in a workflow (init,
autobuild, analyze) is on the same version. Dependabot opened one PR per
step (#2384, #2385, #2386), so each failed Analyze alone. Bumps all three
together to the sha the v4.39.1 tag resolves to, same as each individual PR
proposed.

Author: JarryShaw

.github/workflows/codeql-analysis.yml

@@ -51,15 +51,15 @@ jobs:
 
     # #2130: the config leaves tests/ out of the scan.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+      uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
       with:
         config-file: ./.github/codeql/codeql-config.yml
 
     - name: Autobuild
-      uses: github/codeql-action/autobuild@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+      uses: github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+      uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
 
   # #2030: the run's report, to its thread in Discussions. A pull request's run
   # posts nothing: its findings belong to the pull request, and the alerts the