chore(deps): bump CodeQL actions to 4.38.1 (#3974)

Update CodeQL `init` and `analyze` together from 4.37.8 to 4.38.1,
pinned to the same official release commit. The actions share versioned
state and must remain aligned.

Includes the matching update from #3975. No workflow permissions or SDK
runtime code change; refreshed against current main.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Marcus Wood <marcuswood@openai.com>