chore(ci): bump pinned GitHub Actions SHAs to latest releases

[klobucar]

What this changes

Bumps the pinned commit SHAs for 7 GitHub Actions to their latest releases, and adds .github/workflows/codeql.yml (an existing untracked file in the working tree, now updated to the same SHAs and brought into version control).

Why

Keeps CI on current action releases rather than stale training-data-era pins. Four are major-version bumps: actions/checkout v6→v7, actions/cache v5→v6, github/codeql-action v3→v4, actions/setup-dotnet v5→v6.

How tested

No Rust source changed in this branch, so cargo fmt/clippy/test aren't meaningfully exercised — this is CI-config only. Verified instead:

• Every new SHA resolved via the GitHub API (/commits/{tag}), not git ls-remote — the latter returned unpeeled annotated-tag SHAs for codeql-action and commitlint-github-action that would've mispinned them.
• actionlint on all changed workflow files: clean except one pre-existing shellcheck style nit in macos.yml (unrelated to this change).
• uvx zizmor against codeql.yml with the repo's .github/zizmor.yml config: no findings in the default persona (what CI's zizmor.yml workflow actually runs); pedantic persona surfaces 9 pre-existing informational/low nits (template-injection on env-var interpolation, undocumented job permissions, superfluous dtolnay/rust-toolchain), none introduced by this change and none blocking.
• Manually cross-checked codeql.yml's OPUS_MODEL_CHECKSUM/UNIFFI_BINDGEN_CS_TAG env values and the cron-offset comment against ci.yml/macos.yml/desktop.yml/security.yml — all consistent.

Notes for the reviewer

The codeql-action v3→v4 bump in particular I couldn't exercise end-to-end (can't run GitHub-hosted Actions locally) — worth watching that job on this PR's own CI run. Wasn't able to run zizmor's online audits (need a GH_TOKEN, not available locally) — CI's zizmor.yml job does have actions: read and will run those.

Checklist

• Commit messages follow Conventional Commits
• Commits are signed off (git commit -s) per the DCO
• cargo fmt --all clean — n/a, no Rust files changed
• cargo clippy --workspace --all-targets -- -D warnings clean — n/a, no Rust files changed
• cargo test --workspace passes — n/a, no Rust files changed
• Wire-format / protocol changes have a corresponding update in docs/protocol.md — n/a, no wire changes
• Crypto changes have a corresponding update in docs/MLS_SECURITY.md or docs/05_dave_protocol_deviations.md — n/a, no crypto changes