Bump sample version pin to v1.6.0, automate future bumps on release

[Copilot]

Samples pinned advanced-security/set-codeql-language-matrix to the rolling @v1 major tag. With immutable releases now enabled, a full release tag can't be moved or deleted after publish, making it as secure as a commit SHA while staying human-readable.

README samples

• Bumped all 4 @v1 references to @v1.6.0 (current latest release)
• Added a short note explaining the pinning recommendation and linking to the new automation

Automated version bump on release

• New workflow .github/workflows/bump-sample-version.yml, triggered by release: types: [published]
• Skips prereleases, validates the tag matches vX.Y.Z, then rewrites any @vX.Y.Z pin of this action in README.md to the new tag
• Opens (or updates, if one is already open) a PR via peter-evans/create-pull-request, pinned to a commit SHA per org convention

- name: Get languages from repo
  id: set-matrix
  uses: advanced-security/set-codeql-language-matrix@v1.6.0   # was @v1

Docs

• CONTRIBUTING.md documents the new automated process alongside the existing rolling v1 tag instructions (unaffected — immutable releases only apply going forward)

Note: the workflow's Create Pull Request step requires the repo setting Settings > Actions > General > Workflow permissions > Allow GitHub Actions to create and approve pull requests to be enabled.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite