chore(deps): update submodules (#6048)

This PR contains the following updates:

| Package | Type | Update | Change | Pending |
|---|---|---|---|---|
|
[github/codeql-action](https://redirect.github.com/github/codeql-action)
| action | minor | `v4.37.9` → `v4.38.0` | `v4.38.1` |
| [ruby/setup-ruby](https://redirect.github.com/ruby/setup-ruby) |
action | minor | `v1.321.0` → `v1.323.0` | `v1.325.0` (+1) |
|
[zizmorcore/zizmor-action](https://redirect.github.com/zizmorcore/zizmor-action)
| action | patch | `v0.6.3` → `v0.6.4` | |

---

### Release Notes

<details>
<summary>github/codeql-action (github/codeql-action)</summary>

###
[`v4.38.0`](https://redirect.github.com/github/codeql-action/releases/tag/v4.38.0)

[Compare
Source](https://redirect.github.com/github/codeql-action/compare/v4.37.9...v4.38.0)

- On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL
bundles from the toolcache before downloading a different bundle, which
frees up disk space for the analysis. We expect to roll this change out
to everyone in September.
[#&#8203;4124](https://redirect.github.com/github/codeql-action/pull/4124)
- The CodeQL Action now supports CodeQL releases that are compatible
with Linux Arm64 and downloads the native `linux-arm64` CodeQL bundle
when available.
[#&#8203;4072](https://redirect.github.com/github/codeql-action/pull/4072)
- Update default CodeQL bundle version to
[2.27.0](https://redirect.github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0).
[#&#8203;4129](https://redirect.github.com/github/codeql-action/pull/4129)

</details>

<details>
<summary>ruby/setup-ruby (ruby/setup-ruby)</summary>

###
[`v1.323.0`](https://redirect.github.com/ruby/setup-ruby/releases/tag/v1.323.0)

[Compare
Source](https://redirect.github.com/ruby/setup-ruby/compare/v1.322.0...v1.323.0)

#### What's Changed

- Update CRuby releases on Windows by
[@&#8203;ruby-builder-bot](https://redirect.github.com/ruby-builder-bot)
in [#&#8203;937](https://redirect.github.com/ruby/setup-ruby/pull/937)

**Full Changelog**:
<ruby/setup-ruby@v1.322.0...v1.323.0>

###
[`v1.322.0`](https://redirect.github.com/ruby/setup-ruby/releases/tag/v1.322.0)

[Compare
Source](https://redirect.github.com/ruby/setup-ruby/compare/v1.321.0...v1.322.0)

#### What's Changed

- Add ruby-4.0.7 by
[@&#8203;ruby-builder-bot](https://redirect.github.com/ruby-builder-bot)
in [#&#8203;936](https://redirect.github.com/ruby/setup-ruby/pull/936)

**Full Changelog**:
<ruby/setup-ruby@v1.321.0...v1.322.0>

</details>

<details>
<summary>zizmorcore/zizmor-action (zizmorcore/zizmor-action)</summary>

###
[`v0.6.4`](https://redirect.github.com/zizmorcore/zizmor-action/releases/tag/v0.6.4)

[Compare
Source](https://redirect.github.com/zizmorcore/zizmor-action/compare/v0.6.3...v0.6.4)

[Sponsorship is
appreciated!](https://redirect.github.com/sponsors/woodruffw/)

zizmor 1.30.1 is now the default version.

Release notes: <https://docs.zizmor.sh/release-notes/#&#8203;1301>

</details>

---

### Configuration

📅 **Schedule**: (in timezone Australia/Sydney)

- Branch creation
  - "before 6am on wednesday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/google/osv.dev).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMDMuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjEwMy4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyJdfQ==-->

Author: renovate-bot

.github/workflows/codeql-analysis.yml

@@ -45,7 +45,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+      uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -56,7 +56,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+      uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -70,4 +70,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+      uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0

.github/workflows/docs-deploy.yml

@@ -34,7 +34,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup Ruby
-        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
+        uses: ruby/setup-ruby@984c0c890880bbf811283d6f09c4607c62d210a4 # v1.323.0
         with:
           ruby-version: "4" # Not needed with a .ruby-version file
           bundler-cache: true # runs 'bundle install' and caches installed gems automatically

.github/workflows/scorecards.yml

@@ -50,6 +50,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           sarif_file: results.sarif

.github/workflows/zizmor.yml

@@ -20,4 +20,4 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor 🌈
-        uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4