update codeql and ignore contrib code

[haarg]

Update the CodeQL workflow to use newer versions of the actions. Configure it to directly check out the correct commit. And configure it to ignore the contrib-modules directory.