chore(deps): update github/codeql-action action to v4.38.2

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
github/codeql-action	action	patch	v4.38.0 → v4.38.2

---

Release Notes

github/codeql-action (github/codeql-action)

v4.38.2

Compare Source

• Update default CodeQL bundle version to 2.27.1. #​4160

v4.38.1

Compare Source

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #​4146

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[arcavenai]

Approved at ce31ee6.

• The diff matches the claimed bump. scorecards.yml only: codeql-action/upload-sarif v4.38.0 to v4.38.2. Every new pin resolves to its claimed upstream tag (I resolved the tag through the GitHub API and dereferenced annotated tags).
• Release notes. I found nothing breaking in v4.38.1 or v4.38.2.
• What CI did and didn't exercise. scorecards.yml runs only on push to the default branch or on its schedule, so the PR's CI (Rustfmt, Clippy, tests on Linux and macOS, and cargo-deny, all green at this head) doesn't exercise the bumped step. The same SHA ran green as CodeQL init and analyze in other repos' PRs in this batch.