Fix codeql-action tags after #4335

[dimas-b]

Cf. #4326 (comment)

From Zizmor output in CI:

Warning: ci-security.yml:73: action's hash pin has mismatched or missing version comment: points to commit 68bde559dea0
Warning: ci-security.yml:78: action's hash pin has mismatched or missing version comment: points to commit 68bde559dea0
Warning: ci.yml:276: action's hash pin has mismatched or missing version comment: points to commit 68bde559dea0

Checklist

• 🛡️ Don't disclose security issues! (contact security@apache.org)
• 🔗 Clearly explained why the changes are needed, or linked related issues: Fixes #
• 🧪 Added/updated tests with good coverage, or manually tested (and explained how)
• 💡 Added comments for complex logic
• 🧾 Updated CHANGELOG.md (if needed)
• 📚 Updated documentation in site/content/in-dev/unreleased (if needed)

[flyrain]

Thanks for the fix. BTW, what's wrong with #4335?

[dimas-b]

#4335 did not update tags in comments - which is what Zizmor validates. IDK why it passed CI :)

[flyrain]

Got it, thanks for the explanation, @dimas-b ! It's a bit weird it failed on a wrong comment.