[GrosQuildu]

Summary

• update CodeQL from 2.25.1 to 2.27.4 in test and publish workflows
• refresh the CodeQL Linux checksum and setup-codeql commit pin
• update checkout to 7.0.1, login-action to 4.8.0, and setup-uv to 10.3.3
• sort generated query groups so the docs check is deterministic across platforms

This supersedes #44 with the current dependency versions.

Testing

• actionlint .github/workflows/*.yml
• zizmor .github/workflows/
• make format-check
• codeql test run --threads=0 -- cpp/test go/test (27 passed)
• compiled the Java query with warnings treated as errors
• make generate-table followed by a clean doc/QUERIES.md diff
• ruff check and format check for the generator
• ty check for the generator
• verified the CodeQL 2.27.4 Linux archive checksum against the release checksum file