[AAASM-6239] 🔧 (dependabot): Group codeql-action bumps so they can merge

[Chisanan232]

Part of AAASM-6239.

What changed

Adds .github/dependabot.yml, which this repository did not have. One update
entry, github-actions at /, with open-pull-requests-limit: 0 and a
groups: block covering github/codeql-action*.

Why a repository with no config still needed one

Having no dependabot.yml looked like the safe default and was not:

• .github/workflows/codeql.yml here pins a matched
  github/codeql-action/init + /analyze pair.

• Dependabot security updates are enabled on this repository
  (dependabot_security_updates: enabled, and
  GET /repos/{owner}/{repo}/vulnerability-alerts returns 204 No Content).

• A security advisory does not need this file in order to open pull
  requests. From GitHub's options reference:

  Note: Security update pull requests are not subject to this limit and do
  not count toward it. There is no limit on the number of open pull requests
  for security updates.

• But a groups key can only live in this file. So there was nowhere to
  prevent the split described below — the repository was exposed and had no
  mechanism to stop it.

The split

Dependabot treats init and analyze as two independent dependencies, so one
upstream release opens two pull requests. analyze then refuses to consume a
configuration file written by a different version of init, so each half is
permanently unmergeable on its own.

Proven from GitHub's own annotation on a live instance of this split
(horonomy/fornax-core #199, check run 109651309011):

analyze post-action step failed: Loaded a configuration file for version
'4.38.2', but running version '4.38.1'

warning: 1 issue was detected with this workflow: Not all workflow steps
that use github/codeql-action actions use the same version.

Observed check state on both halves:

check	init-only PR	analyze-only PR
codeql (actions)	FAILURE	FAILURE
codeql (python)	FAILURE	FAILURE
codeql (rust)	FAILURE	FAILURE
CodeQL	NEUTRAL	NEUTRAL
other required checks	SUCCESS	SUCCESS

The CodeQL row is the part worth naming. It goes neutral, not red, so the
pull request page shows a CodeQL entry that is not failing while no analysis
ran at all. A neutral check is not evidence of analysis.

Why this does not change pull-request volume here

open-pull-requests-limit: 0 disables version updates only — see the
quoted note above for security updates being exempt, and:

You can temporarily disable version updates for a package manager by setting
this option to zero.

So this repository keeps seeing exactly as many Dependabot pull requests as it
does today: zero version updates, security updates unaffected. The
version-updates group is declared anyway, so that raising the limit later
cannot silently reintroduce the split.

Why two group entries and not one

applies-to — Specify which type of update the group applies to. When
undefined, defaults to version updates. Supported values: version-updates
or security-updates.

A single group would leave the security-advisory path splitting exactly as
before — the path that actually matters here, since it is the only path
currently enabled.

How this was verified

The file was asserted to parse to exactly the intended structure, with no
surplus keys and no over-long lines:

parsed structure   {'version': 2, 'updates': [<one github-actions entry>]}   PASS
group contents     codeql-action (version-updates) +                         PASS
                   codeql-action-security (security-updates),
                   both matching "github/codeql-action*"
longest line       80 columns

Absence of the file on the default branch was re-confirmed against the live
repository immediately before pushing (404 on both .yml and .yaml).

What this does not do

• No workflow edit. The pins still move via Dependabot; that is the point.
• No version updates enabled. The limit stays at 0.
• No required check relaxed, no pin replaced with a floating tag, no analysis
  language or path excluded.

Scope

19 repositories across both organizations carry a version-locked
codeql-action pair and none had a group. This is one of them; the rest land
under FORNX-426, HORO-1645 and AAASM-6239.

No screenshots or recordings: this workstation's data-handling policy keeps
visual artifacts local, and the evidence above is complete without them.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud