build(deps): sync github/codeql-action pins to v4.36.3

init, autobuild and analyze were pinned to mismatched SHAs, causing
CodeQL "Loaded a configuration file for version X, but running version Y"
configuration errors on main and on every Dependabot bump PR. Pin all
sub-actions to the same release.

Author: markuslf

.github/workflows/codeql.yml

@@ -38,14 +38,14 @@ jobs:
         uses: 'actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0' # v7.0.0
 
       - name: 'Initialize CodeQL'
-        uses: 'github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a' # v4
+        uses: 'github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a' # v4.36.3
         with:
           languages: '${{ matrix.language }}'
 
       - name: 'Autobuild'
-        uses: 'github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e' # v4
+        uses: 'github/codeql-action/autobuild@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a' # v4.36.3
 
       - name: 'Perform CodeQL Analysis'
-        uses: 'github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e' # v4
+        uses: 'github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a' # v4.36.3
         with:
           category: '/language:${{ matrix.language }}'