[Sync] Update project files from source repository (1aa1667)

[mrz1836]

What Changed

• Updated OSV_SCANNER_VERSION from v2.5.0 to v2.5.1 in .github/env/10-security.env
• Removed comment explaining OSV-Scanner pinning (removed 2 lines referencing v2.5.0 release date and installation method)
• Updated MAGE_X_OSV_SCANNER_VERSION from v2.5.0 to v2.5.1 in .github/env/10-mage-x.env
• Updated MAGE_X_VERSION from v1.26.0 to v1.26.1 in .github/env/10-mage-x.env
• Updated GO_COVERAGE_VERSION from v1.5.0 to v1.6.0 in .github/env/10-coverage.env
• Updated CodeQL action from v4.37.6 (commit 5595ccaf) to v4.37.7 (commit ff2f1c62) in .github/workflows/codeql-analysis.yml
• Updated CodeQL analyze and upload actions from v4.37.6 to v4.37.7 across multiple workflow files
• Added timeout-minutes: 20 configuration to the "Run Fortress Full Workflow" job in .github/workflows/fortress-test-matrix.yml

Why It Was Necessary

• Security and coverage tooling updates to incorporate latest patches and features
• OSV-Scanner and MAGE-X version bumps maintain parity between security scanning tools
• CodeQL GitHub Action updates ensure the latest security analysis capabilities
• Timeout configuration prevents hanging CI jobs in the test matrix workflow

Testing Performed

• Automated file synchronization ensures version consistency across environment files
• CI workflow definitions updated with hash-pinned action references for security
• Version bumps follow semantic versioning conventions for patch releases
• Cross-file version parity validated (OSV-Scanner versions match between security.env and mage-x.env)

Impact / Risk

• Breaking Change: None - all updates are minor/patch version bumps
• Risk: Low - changes are limited to dependency version updates and workflow configuration
• CI Impact: Added timeout prevents indefinite workflow execution; all other changes are transparent updates

[mrz1836]

LGTM!