fix(github-deps): correct pinned version comment to v4.37.4

Dependabot bumped the upload-sarif SHA to the v4.37.4 release commit
(f205ea1c3313d32999d8d6a48b4f6530d4437b38) but left the trailing
version comment at # v3. Update it to # v4.37.4 to match the tag that
actually points to the pinned SHA.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Nathan Weinberg <nweinber@redhat.com>

Author: nathan-weinberg

.github/workflows/scorecard.yml

@@ -32,6 +32,6 @@ jobs:
           publish_results: true
 
       - name: Upload SARIF results
-        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v3
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           sarif_file: results.sarif