chore(ci): bump codeql-action init+analyze to v4.37.9 together (#1288)

Supersedes dependabot PRs #1197/#1198, which bumped init and analyze
separately; CodeQL requires init/analyze version coherence, so the split
PRs fail in isolation.

Author: DevBot

.github/workflows/codeql.yml

@@ -38,16 +38,16 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Initialize CodeQL
-        # v4.37.6
-        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3
+        # v4.37.9
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938
         with:
           languages: ${{ matrix.language }}
           # Deno project: no build step needed for TS source analysis
           # CodeQL JS/TS extractor works on raw source files
           queries: security-extended,security-and-quality
 
       - name: Perform CodeQL Analysis
-        # v4.37.6
-        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3
+        # v4.37.9
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938
         with:
           category: '/language:${{matrix.language}}'

tools/check-action-pins.ts

@@ -23,6 +23,8 @@ const ACTION_VERSION_PINS = new Map([
   ],
   ['github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3', 'v4.37.6'],
   ['github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3', 'v4.37.6'],
+  ['github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938', 'v4.37.9'],
+  ['github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938', 'v4.37.9'],
 ]);
 
 // Repos that carry an approved pin above. A full-SHA use of one of these repos