ci: roll up open Dependabot GitHub Action bumps

[cjimti]

Background

Dependabot has five open PRs, all of which bump GitHub Action pins in .github/workflows.
Merging them one at a time causes repeated rebases and five CI runs for what is a single
mechanical change set. Two of them (#31, #29) touch the same file (release.yml) and two
(#34, #32) touch the same file (codeql.yml), so they will conflict-rebase against each other.

Open PRs:

PR	Action	From	To
#34	github/codeql-action/analyze	v4.36.2	v4.37.0
#33	github/codeql-action/upload-sarif	v4.36.2	v4.37.0
#32	github/codeql-action/init	v4.36.2	v4.37.0
#31	docker/login-action	v4.2.0	v4.4.0
#29	docker/setup-qemu-action	v4.1.0	v4.2.0

Goal

Land all five bumps as one rollup PR, and close the individual Dependabot PRs as superseded.

Tasks

• Bump the three github/codeql-action/* pins to the v4.37.0 commit SHA
• Bump docker/login-action to the v4.4.0 commit SHA
• Bump docker/setup-qemu-action to the v4.2.0 commit SHA
• Verify each SHA resolves to the claimed tag in the upstream repo (annotated tags dereferenced)
• Keep the # vX.Y.Z version comments accurate next to each pin
• Run make verify (includes scripts/validate-action-shas.sh)

Acceptance criteria

• All action refs remain pinned to full 40-character commit SHAs; validate-actions passes
• Each new SHA is the commit the corresponding upstream tag points at
• CI (build, test, lint, CodeQL, scorecard) is green on the rollup PR
• Dependabot PRs ci: bump github/codeql-action/analyze from 4.36.2 to 4.37.0 #34, ci: bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 #33, ci: bump github/codeql-action/init from 4.36.2 to 4.37.0 #32, ci: bump docker/login-action from 4.2.0 to 4.4.0 #31, ci: bump docker/setup-qemu-action from 4.1.0 to 4.2.0 #29 are closed and their branches deleted