chore(deps): update github/codeql-action action to v4.39.0 (#2557)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[github/codeql-action](https://redirect.github.com/github/codeql-action)
| action | minor | `v4.38.3` → `v4.39.0` |

---

### Release Notes

<details>
<summary>github/codeql-action</summary>

###
[`v4.39.0`](https://redirect.github.com/github/codeql-action/releases/tag/v4.39.0)

[Compare
Source](https://redirect.github.com/github/codeql-action/compare/v4.38.3...v4.39.0)

- *Breaking change*: Bump the minimum required CodeQL bundle version to
2.20.7.
[#&#8203;4205](https://redirect.github.com/github/codeql-action/pull/4205)
- The `codeql-action/analyze` step now validates that a correct argument
for the `checkout_path` input has been provided. The `checkout_path`
input must be set to the path where the repository that is being
analyzed is checked out at on the runner, if that path is something
other than the workspace root. If the path does not point to a
repository checkout or is different from the path that was used by
`codeql-action/init`, then the CodeQL Action now produces a warning.
[#&#8203;4148](https://redirect.github.com/github/codeql-action/pull/4148)
- Resolved an issue with third-party caching implementations that
prevented caches from being restored correctly.
[#&#8203;4206](https://redirect.github.com/github/codeql-action/pull/4206)
- The `codeql-action/start-proxy` step that is used in Code Scanning
Default Setup now finds CodeQL releases using the same logic as
`codeql-action/init`. This primarily benefits customers who are using
GitHub instances other than `github.com` where the
`codeql-action/start-proxy` step may previously have been unable to
locate recent releases and ended up using outdated versions of the
private registry authentication proxy as a result.
[#&#8203;4198](https://redirect.github.com/github/codeql-action/pull/4198)

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/prometheus/client_java).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNTYuMyIsInVwZGF0ZWRJblZlciI6IjQ0LjE2NC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Author: renovate[bot]

.github/workflows/codeql.yml

@@ -37,7 +37,7 @@ jobs:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-codeql-${{ hashFiles('**/pom.xml') }}
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           languages: java
           tools: linked
@@ -56,6 +56,6 @@ jobs:
           -Djavadoc.skip=true
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           category: /language:java

.github/workflows/scorecard.yml

@@ -41,6 +41,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code scanning
-        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           sarif_file: results.sarif