workflows: fix mis-pinned codeql-action hashes

Signed-off-by: Patrick Linnane <patrick@linnane.io>