ci(deps): group github/codeql-action init and analyze so Dependabot bumps them together #330

What happens

.github/workflows/codeql.yml pins github/codeql-action/init and github/codeql-action/analyze to the same commit. Dependabot bumps them as two pull requests (#325 and #327, 4.38.2 → 4.39.0), and each one on its own fails the Analyze C# check: init and analyze of different versions do not work together. Neither can merge, and they will come back every release of the action.

Fix

Add a group to the github-actions ecosystem in .github/dependabot.yml, next to github-pages:

      codeql-action:
        patterns:
          - "github/codeql-action"

(Dependabot matches the action name without the sub-path, so one pattern covers init and analyze.) Then close #325 and #327 and let the next run open one grouped pull request.

Not caused by any open branch; recorded here so it is worked after the pull request in hand.