ci: re-pin codeql-action to the true v4.38.0 commit

The pin 1c5b675653bb5c22dbe9b12b556ec555138e09fd is the commit that the
annotated tag v4.38.1 dereferences to -- not v4.38.0, despite the trailing
comment claiming otherwise. v4.38.1 is blocked estate-wide (nexia-list#100),
so every repo carrying this pin has in fact been running the blocked version.

  v4.38.0 -> tag object 4bd7200e -> commit b96794f015dfd88f77b49b1c93e0fa7110f94c63
  v4.38.1 -> tag object c23de5a8 -> commit 1c5b675653bb5c22dbe9b12b556ec555138e09fd

Where the ref was a bare tag (@v4.38.1) it was also unpinned -- a mutable ref
upstream can re-point at will -- so it is now pinned to a SHA as well as moved
off the blocked version.

In a number of repos the lock had already been moved to b96794f0 while the
workflow was left on the blocked SHA. Those two disagree, so the workflow is
currently rejected at startup and has not been running at all; this commit
makes the workflow match the lock and brings it back to life.

The workflow and actions.lock are changed in a single commit: GitHub compares
the lock to the workflow by literal string, so a partial edit is a startup
failure rather than a stale lock.

Refs: metadatastician/standards#1005

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -43,12 +43,12 @@ jobs:
         uses: actions/checkout@v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100)
+        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100)
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100)
+        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100)
         with:
           category: "/language:${{ matrix.language }}"