Chore(deps): Bump github/codeql-action to v4.37.2 across all steps (#1865)

The Dependabot PR #1847 bumped only codeql-action/analyze, leaving init
pinned to v4.36.2. CodeQL fails with a configuration error when init and
analyze run different versions:

  Loaded a configuration file for version '4.36.2', but running version '4.37.2'

Bump init, analyze and upload-sarif to the same v4.37.2 commit, and group
github/codeql-action* in dependabot.yml so future updates stay in sync.