chore: bump pinned CodeQL CLI to v2.26.3

[security-lab-bot]

Automated CLI version bump, requested via the "Update CodeQL CLI Version"
workflow (workflow_dispatch, codeql_version: 2.26.3, release_bump: (none)).

This PR:

• Updates .codeqlversion to 2.26.3.
• Pins every codeql/<lang>-all / codeql/<lang>-queries dependencies:
  entry across query/library qlpack.yml files (not */ext or
  */ext-library-sources, whose extensionTargets is intentionally left
  unconstrained and must never be auto-rewritten) to the exact version
  shipped in the official CodeQL Bundle for this CLI release (see
  .github/scripts/pin-codeql-library-versions.sh) - this keeps
  codeql pack upgrade from jumping those libraries to registry-latest instead
  of the version this CLI actually ships/tests against.
• Runs codeql pack upgrade <dir> for every query/library pack directory (again
  excluding */ext and */ext-library-sources) to refresh its
  codeql-pack.lock.yml against the new CLI and pinned library versions.

This PR does not publish anything by itself - no pack version: field is
bumped here, so publish.yml's version-diff trigger won't fire for it yet.
Remaining steps (see CONTRIBUTING.md's "Updating the pinned CodeQL CLI/library
version" section):

• Check CI on this PR - fix any compilation/test errors caused by upstream
  API changes. This is usually the hardest part; consider delegating it to a
  Copilot coding agent session pointed at this PR/branch.
• Review and merge.
• Once merged, run the "CodeQL Update Release" workflow
  (update-release.yml) to bump every pack's version: in lockstep via
  .release.yml and trigger the real batch publish.

[WritingPanda]

👍🏽

[WritingPanda]

Approved these changes with read-only permissions

Dang it