Dependabot bumps action subpaths independently, causing version drift (broke CodeQL CI)

[jamescrosswell]

Problem

Dependabot treats each subpath of an action repository as a separate dependency. github/codeql-action/init and github/codeql-action/analyze are the same repo at the same SHA, but Dependabot opens a PR for one without the other. When only one lands, the two steps run different versions of the action and CodeQL fails hard:

##[error]Loaded a configuration file for version '4.37.3', but running version '4.37.1'
##[error]analyze post-action step failed: Loaded a configuration file for version '4.37.3', but running version '4.37.1'
CodeQL job status was configuration error.

This just happened on #5461 (bumped init to 4.37.3, left analyze on 4.37.1). The Analyze check went red and stayed red until analyze was bumped by hand. This will recur on every CodeQL release.

Blast radius

.github/dependabot.yml has no groups for the github-actions ecosystem, so every multi-subpath action in this repo has the same drift risk:

Repo	Subpaths in use	Status
getsentry/github-workflows	danger, validate-pr, updater, sentry-cli/integration-test (6 active call sites)	in sync at 3.4.0
github/codeql-action	init, analyze	in sync at v4.37.3 (after manual fix)
actions/cache	root + restore	in sync at v6.1.0
getsentry/craft	root + .github/workflows/changelog-preview.yml	already drifted

The getsentry/craft drift is live on main today:

• .github/workflows/release.yml:38 — getsentry/craft@cdb657d4bbc70cd497876ad158984b4d345a48ae # 2.26.14
• .github/workflows/changelog-preview.yml:19 — getsentry/craft/.github/workflows/changelog-preview.yml@9312e4dfc82e545ef0cad911c23f430fe5f52673 # 2.26.12

Two versions apart. It hasn't broken anything because those two are independent, but it shows the failure mode isn't theoretical.

Proposed fix

Add groups to the github-actions entry in .github/dependabot.yml so all subpaths of a given action repo are bumped in a single PR, the way the benchmarkdotnet group already works for the NuGet ecosystem. This makes lockstep the default rather than something we notice after CI goes red.

[linear-code]

NET-780