chore(deps): update github-actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
docker/setup-buildx-action	action	minor	v4.2.0 → v4.3.0
github/codeql-action	action	patch	v4.37.6 → v4.37.7
mikefarah/yq	action	patch	v4.53.3 → v4.53.6

---

Release Notes

docker/setup-buildx-action (docker/setup-buildx-action)

v4.3.0

Compare Source

• Bump @​docker/actions-toolkit from 0.92.0 to 0.95.0 in #​595
• Bump brace-expansion from 1.1.13 to 1.1.18 in #​600
• Bump js-yaml from 5.2.0 to 5.3.0 in #​585
• Bump postcss from 8.5.10 to 8.5.25 in #​598
• Bump undici from 6.27.0 to 6.28.0 in #​601

Full Changelog: docker/setup-buildx-action@v4.2.0...v4.3.0

github/codeql-action (github/codeql-action)

v4.37.7

Compare Source

• Update default CodeQL bundle version to 2.26.3. #​4085

mikefarah/yq (mikefarah/yq)

v4.53.6

Compare Source

v4.53.5

Compare Source

v4.53.4

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[toolhive-release-app]

🔒 MCP Security Scan Results

✅ adb-mysql-mcp-server

• Status: Passed
• Tools scanned: 3
• Result: No security issues detected

✅ agentql-mcp

• Status: Passed
• Tools scanned: 1
• Result: No security issues detected

---

Summary: Scanned 2 MCP server(s), all passed security checks. ✅

[toolhive-release-app]

🛡️ Skill Security Scan Results

✅ agent-observability-eval-bootstrap

• Status: Passed
• Findings: 5
• Allowed (not blocking): 2
  • LLM_PROMPT_INJECTION (Allowed: FP: same as policy_violation above — all pattern matches are on documentation, code examples, or attack pattern descriptions for detection purposes, not agent instructions.)
  • MANIFEST_MISSING_LICENSE (Allowed: datadog-labs/agent-skills is licensed MIT at the repository root; upstream does not embed an SPDX license identifier in per-skill SKILL.md frontmatter.)

---

Summary: Scanned 1 skill(s), all passed security checks. ✅