Add JetBrains/qodana-action v2026.1.3

[lukaszlenart]

And sets previous version expiration within 3 months

[potiuk]

analyze-action-pr: adds qodana-action v2026.1.3 (4861e015, the current tag) and expires the prior v2026.1.0 at 2026-09-25.

Upstream v2026.1.0→v2026.1.3 is a legitimate release (new Maven plugin, Kotlin 2.3.0, CLI v2026.1.3); the action's own scan/dist/index.js bundle changes only +14/-14, matching the CLI version bump — no suspicious patterns.

The only verify failure is the gradle/wrapper/gradle-wrapper.jar in-tree-binary false positive that #951 fixes (the jar is Gradle build tooling, not action-runtime code). LGTM.

[potiuk]

Merging despite the red verify check. Its sole failure is the in-tree-binary check flagging gradle/wrapper/gradle-wrapper.jar — Gradle build tooling, not action-runtime code (qodana-action runs scan/dist/index.js), and checksum-verifiable in its own right. That's a verify-tool false positive, fixed properly in #951; verify is a non-required check here.

Reviewed otherwise clean: correct current v2026.1.3 hash (4861e015), prior version given a 3-month expiry, and the upstream v2026.1.0→v2026.1.3 bump is a legitimate release (the action's scan/dist/index.js bundle changes only +14/-14). Thanks @lukaszlenart!