chore(ci): update CodeQL actions to supported versions

[Gh0stlyKn1ght]

Proposed changes

Update the CodeQL workflow from the retired v2 action line to the supported v4 line, and align checkout with the v4 version already used by the rest of this repository.

This is a minimal follow-up to the maintainer feedback on #2553: it uses version tags rather than commit SHA pins and changes no other workflows or permissions.

Proof

• actionlint passes for .github/workflows/codeql-analysis.yml
• go test ./... passes on the unchanged source baseline with Go 1.27.1
• git diff --check passes
• CodeQL officially supports v4 and v3; v2 is no longer supported

Checklist

• Pull request is created against the dev branch
• All applicable local checks passed
• No product test is required for a version-only workflow update
• No documentation change is required

Submitted by @Gh0stlyKn1ght.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• .github/workflows/codeql-analysis.yml is excluded by !**/*.yml

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 115534cc-6d42-44cc-a0c9-c21c8cf42edc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[Gh0stlyKn1ght]

The workflow now includes its own file in the pull_request path filter so this version update can validate itself. GitHub is currently holding the CodeQL run for first-time-contributor approval (run 33995053038). Once approved, I will monitor and address any failure. Local actionlint, the full Go test suite, and git diff checks pass.