ci: synchronize CodeQL init/analyze to v4.37.6

[stacknil]

Summary

• Synchronize github/codeql-action/init and github/codeql-action/analyze to the same pinned v4.37.6 commit SHA:
  5595ccaf912efad79be6eef63a5619ff05969be3.
• This maintainer PR supersedes split Dependabot PRs chore(deps): bump github/codeql-action/analyze from 4.37.0 to 4.37.6 #105 and chore(deps): bump github/codeql-action/init from 4.37.0 to 4.37.6 #106; they should not be merged independently.

Validation

• actionlint passed for all repository workflows.
• Local pin check confirmed exactly two CodeQL action pins and one shared SHA.
• git diff --check passed.
• Required remote validation: CI and CodeQL checks on this maintainer PR.

Review protocol

• Design decision: keep init and analyze on one immutable commit so the CodeQL workflow cannot run a mixed action version.
• Main risk: CodeQL action behavior changes with the v4.37.6 update; the pinned SHA makes the change reproducible and reviewable.
• Compatibility impact: no application/runtime changes; only GitHub Actions security-analysis tooling changes.
• Rollback path: revert 459a244 to restore the previous v4.37.0 pin.
• After this PR is merged and verified, close chore(deps): bump github/codeql-action/analyze from 4.37.0 to 4.37.6 #105 and chore(deps): bump github/codeql-action/init from 4.37.0 to 4.37.6 #106 without merging them.