chore(ci): correct codeql-action version comment to match pinned SHA

The github/codeql-action/init and analyze steps were pinned to SHA
8aad20d150bbac5944a9f9d289da16a4b0d87c1e but annotated with a '# v4'
comment. That SHA is the v4.36.2 release, and the moving 'v4' tag now
resolves to a different commit, so zizmor's ref-version-mismatch rule
flags the comment as untruthful. Update the comment to '# v4.36.2' to
reflect the actual pinned ref, matching how other actions in this
workflow annotate their exact versions (e.g. actions/checkout # v7.0.0).

Resolves code-scanning alert #2560

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/codeql-analysis.yml

@@ -64,7 +64,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -75,6 +75,6 @@ jobs:
           # queries: security-extended,security-and-quality
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           category: "/language:${{matrix.language}}"