chore: consolidate September dependency updates

[Codewriter90x]

Summary

• update coverage to 7.16.0, mypy to 2.3.1, and Ruff to 0.16.5
• update attest-build-provenance to 4.2.2 using its immutable commit SHA
• update both CodeQL init and analyze to 4.37.9 in the same workflow revision
• group github/codeql-action components in Dependabot to prevent split, incompatible updates

This supersedes Dependabot PRs #33, #34, #35, #36, #37, and #38.

Verification

• Ruff: passed
• mypy: passed
• immutable workflow pin validation: passed
• Python unit tests: 55 passed
• JavaScript tests: 9 passed
• dataset and source validation: passed
• deterministic build: passed
• geography rebuild verification: passed
• Pages build and validation: passed
• release build and validation: passed

The protected GitHub checks remain the merge gate, including coverage on Python 3.12, the Python 3.11-3.14 matrix, data quality, and both CodeQL languages.