Bump github/codeql-action from 4.36.0 to 4.36.2

apple/pkl-spring#60 mergedci-only

What it touches

ci: 2

Modules: .github (2)

Architectural impact (arcade-agent diff_impact)

No production Java file of this PR maps into the dependency graph (tests, build, CI or docs only). Tests are excluded from the graph by design.

Build & CI relevance

• Touches CI workflows: review runner matrix, timeouts, caching.

Files