Auto-updated submodule references: Bump codeql

Bumps [codeql](https://github.com/github/codeql) from `e7384da` to `3d9f9af`.
- [Commits](github/codeql@e7384da...3d9f9af)

---
updated-dependencies:
- dependency-name: codeql
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>