Group github/codeql-action updates in Dependabot to prevent version skew

## Background

CodeQL recently started failing on `main` and every branch with:

> Loaded a configuration file for version '4.37.1', but running version '4.37.0'

Dependabot treats each `uses:` line as a separate dependency, so it bumped `github/codeql-action/init` to v4.37.1 while leaving `github/codeql-action/analyze` on v4.37.0. CodeQL requires all of its action steps to run the same version, so `analyze` failed.

The immediate skew was fixed in getsentry/sentry-dotnet@4216c8006356d018837fa23b02ea16f2c957e915 (aligning `analyze` to v4.37.1), landed opportunistically on PR #5414 to get CI green without stacking a separate PR — see https://github.com/getsentry/sentry-dotnet/pull/5414#issuecomment-5028156475.

## Problem

That was a manual patch. Nothing prevents the same drift from recurring the next time one `codeql-action` sub-action is bumped ahead of the other.

## Proposed fix

Add a Dependabot `group` to the existing `github-actions` ecosystem in `.github/dependabot.yml` so all `github/codeql-action/*` sub-actions are always bumped together in a single atomic PR:

```yaml
- package-ecosystem: "github-actions"
directories:
- "/"
- "/.github/actions/*"
schedule:
interval: weekly
groups:
codeql:
patterns:
- "github/codeql-action*"
```

With this, `init` and `analyze` can no longer drift apart.

## Optional follow-up

A small CI guard that asserts every `github/codeql-action/*` ref resolves to the same version/SHA would catch drift from any source (manual edits, bad merges), not just Dependabot. Nice-to-have, not required for this issue.

Open .github/dependabot.yml and find the existing github-actions ecosystem entry. Add the proposed codeql group pattern, then inspect the GitHub Actions references to confirm the pattern covers the CodeQL sub-actions and that the configuration remains valid; done means future CodeQL updates are grouped into one Dependabot PR.

Written by the indexing model from the issue text.