actionlint: bump upload-sarif to v3.28.5

[woodruffw]

This addresses GHSA-vqf5-2xx6-9wfm.

That vulnerability has no direct impact on us since we're not doing Java/Kotlin scanning, but there's also no reason to keep it on our radar.

Detected with zizmor:

error[known-vulnerable-actions]: action has a known vulnerability
  --> .github/workflows/actionlint.yml:82:9
   |
82 |         uses: github/codeql-action/upload-sarif@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ GHSA-vqf5-2xx6-9wfm
   |
   = note: audit confidence → High

[woodruffw]

For cross-check: version and digest were pulled from here: https://github.com/github/codeql-action/releases/tag/v3.28.5