Pin CodeQL SARIF action comment to v4.37.6

[samuv]

Summary

The upload-sarif action is pinned to commit 5595ccaf91... but the trailing
version comment still said # v4, while that commit actually corresponds to
tag v4.37.6. zizmor's ref-version-mismatch audit flags this drift on every
PR/main run of the security-scan workflow.

• Update the version comment on the github/codeql-action/upload-sarif pin
  in .github/workflows/security-scan.yml from # v4 to # v4.37.6 so it
  matches the tag the pinned commit actually points to.

Type of change

• Bug fix

Test plan

• Manual testing (describe below)

Verified the pinned commit 5595ccaf912efad79be6eef63a5619ff05969be3 is the
commit tagged v4.37.6 in github/codeql-action, matching zizmor's finding
and fix suggestion.

Does this introduce a user-facing change?

No.

Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.87%. Comparing base (7854115) to head (3fcfde4).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6313      +/-   ##
==========================================
+ Coverage   72.82%   72.87%   +0.04%     
==========================================
  Files         742      742              
  Lines       77762    77804      +42     
==========================================
+ Hits        56632    56696      +64     
+ Misses      17155    17114      -41     
- Partials     3975     3994      +19     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.