ci(fallow): give the SARIF upload a category so it stops colliding with CodeQL (#134)

Follow-up to #124. That PR fixed the flag error (`--output` is an alias of
`--format`, so `--format sarif --output fallow.sarif` aborted and no file was
written) — `Run fallow full scan` now succeeds on master and does produce
fallow.sarif. The next step then failed instead:

  ##[error]The CodeQL Action does not support uploading multiple SARIF runs
  with the same category. Please update your workflow to upload a single run
  per category.

Code scanning keys analyses by `category`, and with no explicit category this
upload lands in the same default bucket as CodeQL's own run for the same
commit. Setting `category: fallow` keeps the two separable and lets the upload
complete.

Verified against the action's own input schema: `category` is an optional
string used "by Code Scanning for matching the analyses".

.github/workflows/fallow.yml

@@ -71,6 +71,13 @@ jobs:
         uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: fallow.sarif
+          # Code scanning keys analyses by `category`. Without one here, this
+          # upload collides with CodeQL's own run for the same commit and the
+          # step fails with:
+          #   "The CodeQL Action does not support uploading multiple SARIF runs
+          #    with the same category."
+          # A distinct category keeps Fallow's findings separable from CodeQL's.
+          category: fallow
       - name: Archive log
         if: always()
         uses: actions/upload-artifact@v4