ci(scorecard): also pin codeql-action upload-sarif to commit SHA

Followup to the scorecard-action SHA fix in the previous commit. The
codeql-action v4 pin (b25d0ebf...) was also a tag-object SHA, which
the OSSF Scorecard webapp's post-hoc workflow verification rejects
the same way as scorecard-action did:

  imposter commit: b25d0ebf... does not belong to github/codeql-action/upload-sarif

Replace with the v4 commit SHA (95e58e9a...).

Refs: Redmine #2362

Author: Avicennasis

.github/workflows/scorecard.yml

@@ -40,6 +40,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@b25d0ebf40e5b63ee81e1bd6e5d2a12b7c2aeb61 # v4
+        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
         with:
           sarif_file: results.sarif