Consolidate dependency updates and Dependabot grouping

[mkajander]

What changed

• update all CodeQL components atomically to 4.37.0
• update both the TruffleHog action wrapper and scanner to 3.95.8
• update Microsoft.NET.Test.Sdk to 18.7.0
• group CodeQL updates so init, autobuild, and analyze stay on one revision
• group minor/patch GitHub Actions and .NET tooling updates while leaving majors and security updates separate
• collect XPlat coverage in CI so future Coverlet bumps exercise the collector

Why

Dependabot opened separate CodeQL component PRs that fail when mixed versions run together. The TruffleHog wrapper PR also left the explicitly pinned scanner on 3.93.3. Grouping compatible low-risk updates reduces PR volume while keeping major and security updates individually reviewable.

Supersedes #41, #44, #50, #51, #52, and #53.

Validation

• parsed all Dependabot and workflow YAML files
• restored and built the solution in Release mode with zero warnings
• passed all 25 tests with XPlat Code Coverage and generated Cobertura output
• packed the .NET tool successfully
• ran the exact TruffleHog 3.95.8 container image

[Copilot]

Pull request overview

This PR consolidates several dependency updates (GitHub Actions + .NET test tooling) and adds Dependabot grouping to reduce update PR churn while keeping related components (notably CodeQL) aligned to a single revision.

Changes:

• Bumps CodeQL workflow steps (init/autobuild/analyze) to the same pinned revision to prevent mixed-version failures.
• Updates TruffleHog action wrapper pin and aligns the explicitly pinned TruffleHog scanner version to 3.95.8.
• Updates test tooling (Microsoft.NET.Test.Sdk to 18.7.0) and enables XPlat Code Coverage collection in CI; adds Dependabot groups for minor/patch updates.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tests/Bbt.Core.Tests/Bbt.Core.Tests.csproj	Updates Microsoft.NET.Test.Sdk to 18.7.0 for the test project.
.github/workflows/trufflehog.yml	Updates the TruffleHog action pin and scanner version to 3.95.8.
.github/workflows/codeql.yml	Pins CodeQL init/autobuild/analyze to the same updated revision.
.github/workflows/ci.yml	Enables XPlat Code Coverage collection during dotnet test in CI.
.github/dependabot.yml	Adds grouping rules for CodeQL and minor/patch GitHub Actions + .NET tooling updates.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.