fix: bump codeql-action v3→v4, add permissions to post-publish

- github/codeql-action bumped from v3 to v4 (latest major)
- post-publish job gets permissions: contents: write (needed by
  maven-dependency-submission-action to submit the dependency graph)

https://claude.ai/code/session_01TPLSUAgEHPFGSoDesiPZ5N

Author: claude

.github/workflows/codeql.yml

@@ -17,8 +17,8 @@ jobs:
       - uses: actions/checkout@v6
       - uses: actions/setup-java@v5
         with: { java-version: '8', distribution: zulu }
-      - uses: github/codeql-action/init@v3
+      - uses: github/codeql-action/init@v4
         with: { languages: java, queries: +security-and-quality }
-      - uses: github/codeql-action/autobuild@v3
-      - uses: github/codeql-action/analyze@v3
+      - uses: github/codeql-action/autobuild@v4
+      - uses: github/codeql-action/analyze@v4
         with: { category: "/language:java" }

.github/workflows/publish.yml

@@ -665,6 +665,8 @@ jobs:
       (needs.publish-snapshot.result == 'success' ||
        needs.publish-release.result == 'success')
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-java@v5