ci: update to latest codeql reporter

[rsdmike]

Updates rsdmike/github-security-report-action to v4.0.1, pinned to commit SHA 1df22b1e0a7e15b32f728ccf7bab259e46c80589.

[Copilot]

Pull request overview

Updates the CodeQL security-report generation step in the repository’s CodeQL workflow by bumping the rsdmike/github-security-report-action dependency to the latest major version (pinned by commit SHA), keeping the security reporting pipeline current.

Changes:

• Bump rsdmike/github-security-report-action from v3.0.4 to v4.0.1 (pinned to 1df22b1e0a7e15b32f728ccf7bab259e46c80589).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[rsdmike]

Closing as obsolete.

The v3.0.4 → v4.0.1 bump this PR carried was already merged via #2149, so the report-action change here is a no-op against main.

More importantly, merging it now would regress the CodeQL action. This branch was cut on 2026-08-29 when main pinned github/codeql-action v4.37.8; main has since moved to v4.37.9, so this PR's diff would downgrade init, autobuild, and analyze back to v4.37.8.

#2150 supersedes it: v4.1.0 of the report action (which fixes the GraphQL timedout on the dependency-graph query), continue-on-error dropped so failures are visible, and guards so the step skips cleanly on fork and Dependabot PRs where SECURITY_TOKEN isn't reachable. It's rebased onto current main and keeps codeql-action at v4.37.9.

https://claude.ai/code/session_01VivkdrFB8x5pEWnxmM6gMm