chore(deps): bump github/codeql-action/upload-sarif from 4.37.6 to 4.37.7 (#172)

Updates the SHA-pinned github/codeql-action/upload-sarif action from
v4.37.6 to v4.37.7 in .github/workflows/security-scan.yml (both the IaC
and image SARIF upload steps). Patch bump; updates the default CodeQL
bundle to 2.26.3. Clean-branch replacement for Dependabot PR #171.


Claude-Session: https://claude.ai/code/session_01HeGvNKbfYjVu91a93JMEor

Co-authored-by: Claude <noreply@anthropic.com>

Author: nbon12

.github/workflows/security-scan.yml

@@ -61,7 +61,7 @@ jobs:
       - name: Upload IaC SARIF to Code Scanning
         if: steps.detect.outputs.present == 'true'
         continue-on-error: true   # Code Scanning may be unavailable on private repos w/o GHAS
-        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           sarif_file: trivy-iac.sarif
           category: trivy-iac
@@ -134,7 +134,7 @@ jobs:
 
       - name: Upload image SARIF to Code Scanning
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           sarif_file: trivy-image.sarif
           category: trivy-image