[workflows] Add ref and sha to codeql analyze action

[jbudz]

This workflow currently checkouts out two separate branches, but uses the default branch as a reference when analyzing. We want the results to split by the branch.

See https://github.com/github/codeql-action/blob/main/analyze/action.yml for a description of supported options.