ci: pin codeql-action/analyze to v4.36.3 to match init (#638)

The init and analyze steps were pinned to different codeql-action
versions (4.36.3 vs 4.36.2), causing analyze to fail with
"Loaded a configuration file for version '4.36.3', but running
version '4.36.2'".

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Author: rkennke