Bump the codeql group across 1 directory with 2 updates

apple/pkl-spring#87 mergedci-only

What it touches

ci: 2

Modules: .github (2)

Architectural impact (arcade-agent diff_impact)

No production Java file of this PR maps into the dependency graph (tests, build, CI or docs only). Tests are excluded from the graph by design.

Build & CI relevance

• Touches CI workflows: review runner matrix, timeouts, caching.

Files