ci: bump github/codeql-action to v4.38.2

[kalyazin]

Dependabot opened this bump as three pull requests, one per action path. They cannot land separately: init, analyze and upload-sarif must share a revision, and bumping one alone fails both CodeQL jobs with Loaded a configuration file for version '4.38.2', but running version '4.38.1' — observed on the init and analyze pull requests, where the jobs died after init and left an empty failed-run SARIF under each category.

ACTION_PINS in .github/scripts/security-workflow.test.py moves in the same commit; the shape test fails while the workflow and the pin disagree, which is what made the three split bumps red.

Verified: the three script tests pass; reverting the pin in the test alone puts the shape test red on all three uses.

Supersedes the three split bumps.

[cursor]

PR Summary

Low Risk
Routine pinned-action version bump for CI only; no application or auth logic changes.

Overview
Bumps github/codeql-action from v4.38.1 to v4.38.2 across the security workflow in one commit so init, analyze, and upload-sarif all use the same commit SHA (2892aa5e…).

The workflow shape test’s ACTION_PINS entry for github/codeql-action is updated to match, keeping the allowlist in sync with security.yml (split Dependabot bumps would leave mixed versions and fail CodeQL with a config/runtime version mismatch).

^{Reviewed by Cursor Bugbot for commit ed6837d. Bugbot is set up for automated code reviews on this repo. Configure here.}