Merge branch 'main' into enable_semgrep_zizmor

Author: adimoft

.github/dependabot.yml

@@ -43,6 +43,11 @@ updates:
     directory: /
     schedule:
       interval: daily
+    # codeql-action's sub-actions release in lockstep; one PR instead of four.
+    groups:
+      codeql-action:
+        patterns:
+          - 'github/codeql-action*'
 
   - package-ecosystem: docker
     directory: /