chore(ci): bump codeql-action v3.35.5 -> v4.36.0 (#13)

CodeQL Action v3 is deprecated (December 2026) and runs on Node 20, which
reaches end-of-life 30 April 2026. v4 runs on Node 24. No breaking change for
github.com-hosted runners (only GHES <=3.18 is affected, which we do not use).
Empirically confirmed safe: HexGol PR #21 already merged this bump with all CI
(incl. e2e) green.

SHA-pinned to 7211b7c8077ea37d8641b6271f6a365a22a5fbfa (v4.36.0, API-verified).

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: marcohost33-maker

.github/workflows/scorecard.yml

@@ -53,6 +53,6 @@ jobs:
       - name: Upload to code-scanning
         if: ${{ !cancelled() && hashFiles('results.sarif') != '' }}
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@458d36d7d4f47d0dd16ca424c1d3cda0060f1360  # v3.35.5
+        uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa  # v4.36.0
         with:
           sarif_file: results.sarif

.github/workflows/zizmor.yml

@@ -52,7 +52,7 @@ jobs:
         # upload failing on private repos without GitHub Advanced Security.
         if: ${{ !cancelled() && hashFiles('zizmor.sarif') != '' }}
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@458d36d7d4f47d0dd16ca424c1d3cda0060f1360  # v3.35.5
+        uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa  # v4.36.0
         with:
           sarif_file: zizmor.sarif
           category: zizmor