ci/deps: roll up open Dependabot bumps (round 2) #43

Background

A second batch of Dependabot PRs is open (#37–#42). As before, several touch the same
workflow files and would rebase against each other if merged individually. Rolling them
up keeps it to one CI run.

Note: the codeql PRs are labeled "from 4.36.2" but master already carries 4.37.0 (merged in
#36), so the effective bump is 4.37.0 → 4.37.2 after rebase.

Tasks

• Bump the three github/codeql-action/* pins to the v4.37.2 commit SHA
• Bump actions/setup-go to v7.0.0 (four occurrences in ci.yml, plus codeql.yml, release.yml)
• Bump actions/setup-python to v7.0.0 (docs.yml)
• Bump prometheus/client_golang to v1.24.0 via go get + go mod tidy (regenerate, don't hand-edit)
• Verify each action SHA resolves to its tag upstream (dereference annotated tags)
• Run make verify; confirm the binary still reports rtbeat version 7.17.29

Acceptance criteria

• All action refs remain pinned to full 40-char SHAs; validate-actions passes
• go.mod/go.sum regenerated by the Go toolchain; tidy-check passes
• libbeat/rxtx fragile pins untouched
• CI green
• Dependabot PRs ci: bump github/codeql-action/init from 4.37.0 to 4.37.2 #37, ci: bump actions/setup-go from 6.5.0 to 7.0.0 #38, ci: bump actions/setup-python from 6.3.0 to 7.0.0 #39, deps: bump github.com/prometheus/client_golang from 1.23.2 to 1.24.0 #40, ci: bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.2 #41, ci: bump github/codeql-action/analyze from 4.37.0 to 4.37.2 #42 closed as superseded