CodeQL has been failing on main since #2105: `init` is on v4.37.9 while
`autobuild` and `analyze` are on v4.37.8, and the action rejects a
config written by a newer version ("Loaded a configuration file for
version '4.37.9', but running version '4.37.8'"). Dependabot bumps the
three steps in separate pull requests, so #2119 and #2120 each still
fail on their own and main has gone red at every partial bump (08-19,
08-28, today).
This moves the two steps to v4.37.9, the same commit dependabot picked
in #2119 and #2120, and groups `github/codeql-action*` in dependabot so
the three bump together from now on. Supersedes #2119 and #2120.
## Launch Checklist
- [x] Briefly describe the changes in this PR.
- [ ] Add an entry to `CHANGELOG.md` under the `## main` section (not
applicable, CI only).
Towards #971
- #971
The dependabot script appear broken. This copies the config from
maplibre-gl-js, which we know work.
## Launch Checklist
<!-- Thanks for the PR! Feel free to add or remove items from the
checklist. -->
- [ ] Briefly describe the changes in this PR.
- [ ] Link to related issues.
- [ ] Include before/after visuals or gifs if this PR includes visual
changes.
- [ ] Write tests for all new functionality.
- [ ] Add an entry to `CHANGELOG.md` under the `## main` section.
John Carmack
Harel M
Frank Elsinga
Birk Skyum