ci: update reviewed GitHub Action pins

[dependabot]

Summary

• update CodeQL init, analyze, and upload-sarif to v4.37.3
• update setup-uv to v9.0.0
• update gh-action-pypi-publish to v1.14.1

This consolidates PRs #19, #20, #21, and #22. It keeps CodeQL phases on one immutable pin and avoids broken intermediate merges.

Verification

• uv locked install
• Ruff format and lint
• pip-audit
• 47 tests passed, 1 skipped, with 100% coverage
• reproducible source and wheel builds
• actionlint

Summary by CodeRabbit

• Chores
  • Updated automated testing and security-checking workflows to use newer tooling.
  • Improved the reliability of package publishing and distribution processes.
  • Refreshed security reporting integrations for more consistent code-scanning results.

Note

Update pinned GitHub Actions to latest versions across CI workflows

Bumps action pins across all GitHub Actions workflows:

• Updates astral-sh/setup-uv from v8.3.2 to v9.0.0 in ci.yml and publish.yml
• Updates github/codeql-action from v4.37.1 to v4.37.3 in codeql.yml and scorecard.yml
• Updates pypa/gh-action-pypi-publish from v1.14.0 to v1.14.1 in publish.yml

Changes since #18 opened

• Removed path filter from pull_request trigger in fuzz.yml workflow [63093de]

^{Macroscope summarized 53d7da4.}

[coderabbitai]

📝 Walkthrough

Walkthrough

The pull request updates pinned GitHub Actions used by CI, PyPI publishing, CodeQL analysis, and Scorecard SARIF uploads.

Changes

Workflow action updates

Layer / File(s)	Summary
Build and publishing action pins .github/workflows/ci.yml, .github/workflows/publish.yml	The setup-uv action is updated in CI and publishing, and the PyPI publishing action is updated to newer pinned revisions.
Security scanning action pins .github/workflows/codeql.yml, .github/workflows/scorecard.yml	CodeQL initialization, analysis, and Scorecard SARIF upload steps use newer pinned CodeQL action revisions while retaining their existing configuration.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: kriptoburak

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the workflow change: updating reviewed GitHub Action pins.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/github_actions/github/codeql-action/analyze-4.37.3

---

_{Comment @coderabbitai help to get the list of available commands.}

[furkanerday]

Reviewed the complete current diff, description, commit history, checks, discussion, repository policy, relevant contracts and tests, dependency and release integrity, licensing, DCO, and public-safety implications. Required checks are green and no actionable review threads remain.