Group CodeQL action updates

Dependabot treats the github/codeql-action subpath actions (init,
analyze, autobuild) as separate dependencies and opens a separate PR
for each. CI fails unless they are all updated together. Group them so
that they arrive as a single PR.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: horgh

.github/dependabot.yml

@@ -15,5 +15,9 @@ updates:
       interval: weekly
       day: monday
       time: '14:00'
+    groups:
+      codeql:
+        patterns:
+          - github/codeql-action*
     cooldown:
       default-days: 7