chore(deps): Bump the codeql-actions group across 1 directory with 2 updates

Bumps the codeql-actions group with 2 updates in the / directory: [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.37.5 to 4.37.6
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](d1ba80a13d...5595ccaf91)

Updates `github/codeql-action/analyze` from 4.37.5 to 4.37.6
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](d1ba80a13d...5595ccaf91)

---
updated-dependencies:
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/.e2e-run.yml

@@ -130,6 +130,8 @@ jobs:
         name: Login to Registry
         if: github.event_name != 'pull_request' && (inputs.type == 'remote' || inputs.provider == 'aws' || env.REGISTRY_USER != '')
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        env:
+          DOCKERHUB_OIDC_CONNECTIONID: ${{ inputs.provider == 'dockerhub' && vars.DOCKERHUB_OIDC_CONNECTIONID || '' }}
         with:
           registry: ${{ env.REGISTRY_FQDN || inputs.registry }}
           username: ${{ env.REGISTRY_USER || secrets.registry_username || (inputs.registry == 'ghcr.io' && github.actor) || '' }}

.github/workflows/codeql.yml

@@ -35,12 +35,12 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
       -
         name: Initialize CodeQL
-        uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           languages: javascript-typescript
           build-mode: none
       -
         name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           category: "/language:javascript-typescript"

.github/workflows/e2e.yml

@@ -22,7 +22,7 @@ jobs:
     uses: ./.github/workflows/.e2e-run.yml
     permissions:
       contents: read
-      id-token: write # to get AWS credentials
+      id-token: write # to get Docker Hub and AWS credentials
       packages: write # to push image to GHCR
     strategy:
       fail-fast: false
@@ -107,10 +107,10 @@ jobs:
     secrets:
       # Pass only the registry-specific secrets needed by each matrix entry.
       # GHCR uses the called workflow's GITHUB_TOKEN fallback.
-      # AWS ECR uses OIDC to get credentials.
+      # Docker Hub and AWS ECR use OIDC to get credentials.
       registry_username: >-
         ${{
-          matrix.provider == 'dockerhub' && vars.DOCKERPUBLICBOT_USERNAME ||
+          matrix.provider == 'dockerhub' && 'dockereng' ||
           matrix.provider == 'gitlab' && secrets.GITLAB_USERNAME ||
           matrix.provider == 'gar' && secrets.GAR_USERNAME ||
           matrix.provider == 'acr' && secrets.AZURE_CLIENT_ID ||
@@ -120,7 +120,6 @@ jobs:
         }}
       registry_password: >-
         ${{
-          matrix.provider == 'dockerhub' && secrets.DOCKERPUBLICBOT_WRITE_PAT ||
           matrix.provider == 'gitlab' && secrets.GITLAB_TOKEN ||
           matrix.provider == 'gar' && secrets.GAR_JSON_KEY ||
           matrix.provider == 'acr' && secrets.AZURE_CLIENT_SECRET ||