chore: bump pinned CodeQL CLI to v2.21.4

[security-lab-bot]

Automated CLI version bump, requested via the "Update CodeQL CLI Version"
workflow (workflow_dispatch, codeql_version: 2.21.4).

This PR:

• Updates .codeqlversion to 2.21.4.
• Pins every codeql/<lang>-all / codeql/<lang>-queries dependency across all
  qlpack.yml files to the exact version shipped in the official CodeQL Bundle
  for this CLI release (see .github/scripts/pin-codeql-library-versions.sh) -
  this keeps codeql pack upgrade from jumping those libraries to
  registry-latest instead of the version this CLI actually ships/tests against.
• Runs codeql pack upgrade <dir> for every pack directory to refresh its
  codeql-pack.lock.yml against the new CLI and pinned library versions.

This PR does not publish anything by itself - no pack version: field is
bumped here, so publish.yml's version-diff trigger won't fire for it yet.
Remaining steps (see CONTRIBUTING.md's "Updating the pinned CodeQL CLI/library
version" section):

• Check CI on this PR - fix any compilation/test errors caused by upstream
  API changes. This is usually the hardest part; consider delegating it to a
  Copilot coding agent session pointed at this PR/branch.
• Update the "Supported CodeQL versions" table in CONTRIBUTING.md.
• Review and merge.
• Once merged, run the "CodeQL Update Release" workflow
  (update-release.yml) to bump every pack's version: in lockstep via
  .release.yml and trigger the real batch publish.

[felickz]

Closing - another live validation test of #163 (workflow_dispatch against the fix branch again, after fixing the codeql_home vendored-pack exclusion a reviewer caught). Confirmed clean this time: exactly 27 pack directories processed (all 7 languages' real src/lib/ext/ext-library-sources/test dirs), zero from codeql_home/codeql/*/downgrades. Same diff shape as #164. Real 2.21.4 bump PR will be opened against main once #163 merges.