Update CI jobs to support PR branches (#4189)

* fix(ci): check out correct repo+ref for PRs. Addresses #3999

* fix(ci): update a bunch of other CI jobs to specify refs. For #3999

.github/workflows/codeql-analysis.yml

@@ -41,6 +41,7 @@ jobs:
         if: github.event_name == 'pull_request'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Check out repository code
         uses: actions/checkout@v4