chore: bump pinned CodeQL CLI to v2.26.2 and release v0.7.3

[security-lab-bot]

Automated CLI version bump, requested via the "Update CodeQL CLI Version"
workflow (workflow_dispatch, codeql_version: 2.26.2, release_bump: patch).

This PR:

• Updates .codeqlversion to 2.26.2.

• Pins every codeql/<lang>-all / codeql/<lang>-queries dependency across all
  qlpack.yml files to the exact version shipped in the official CodeQL Bundle
  for this CLI release (see .github/scripts/pin-codeql-library-versions.sh) -
  this keeps codeql pack upgrade from jumping those libraries to
  registry-latest instead of the version this CLI actually ships/tests against.

• Runs codeql pack upgrade <dir> for every pack directory to refresh its
  codeql-pack.lock.yml against the new CLI and pinned library versions.

• Also bumps the repo release version (patch, via the same
  patch-release-me step update-release.yml uses) to 0.7.3,
  propagating it to every pack's own version: field, configs/*.yml
  references, and cross-pack -libs pins.

Merging this PR triggers the real batch publish - publish.yml's
auto-trigger fires on any push to main that changes .release.yml, which this
PR does. No separate "CodeQL Update Release" run is needed. That run's summary
job will create the matching GitHub Release as a full release
(release_prerelease: false).

Remaining steps (see CONTRIBUTING.md's "Updating the pinned CodeQL CLI/library
version" section):

• Check CI on this PR - fix any compilation/test errors caused by upstream
  API changes. This is usually the hardest part; consider delegating it to a
  Copilot coding agent session pointed at this PR/branch.
• Review and merge - this alone will trigger the real batch publish.