fixup: hold back actions/checkout SHA in codeql.yml to match main (per #71)

Even with codeql-action reverted to c6f9311, the bumped
actions/checkout@1cce339 still triggers "no JS/TS source code seen"
on the analyze step. main with checkout@de0fac2 + same CodeQL bundle
2.25.5 succeeds. Hold checkout back ONLY in codeql.yml until #71 is
resolved (either drop the JS/TS analyze leg or move to a richer
build-mode).

All other workflows keep the actions/checkout@1cce339 bump.

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -35,7 +35,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@1cce3390c2bfda521930d01229c073c7ff920824 # v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (held back per #71)
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3