ci: bump codeql-action to v4.37.0 and group future bumps

init/analyze must stay on the same codeql-action version or analyze
rejects init's config; group them in dependabot.yml so bumps land
together atomically instead of drifting across separate PRs.

Author: jbachorik

.github/dependabot.yml

@@ -60,5 +60,12 @@ updates:
       - "dependencies"
       - "no-release-notes"
       - "no-review"
+    groups:
+      # init and analyze must stay on the same codeql-action version, or analyze
+      # rejects init's config with "Loaded a configuration file for version X,
+      # but running version Y" (see PR #638, #651/#652).
+      codeql-action:
+        patterns:
+          - "github/codeql-action*"
     cooldown:
       default-days: 2

.github/workflows/codecheck.yml

@@ -76,7 +76,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -85,4 +85,4 @@ jobs:
           # queries: ./path/to/local/query, your-org/your-repo/queries@main
       - run: ./gradlew -x test assembleReleaseJar
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
+        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0