The default setup CodeQL workflow uses github/codeql-action@v4 which
calls the GitHub API to check for feature enablement. This API call
requires OIDC (id-token: write) authentication and fails with
"HttpError: Requires authentication", causing "Analyze (python)" to fail.
codeql-action@v3 does not have this feature detection code, so it does
not make the failing API call. The custom workflow uses v3.28.9
(SHA: 9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0) with proper permissions
(security-events: write, actions: read, contents: read, packages: read)
and without id-token: write.
Analyzes: actions, javascript-typescript, python
