codeql workflow: Switch from pip to apt

On some runs:

Run pip install --break-system-packages -r requirements.txt
....
no such option: --break-system-packages
Error: Process completed with exit code 2.

On other runs it refuses to install and asks for that option
as it refuses to override system packages.

Also require ubuntu-latest only, as MacOS is not supported at all
by libfuse.

.github/workflows/codeql.yml

@@ -25,7 +25,7 @@ jobs:
     #   - https://gh.io/supported-runners-and-hardware-resources
     #   - https://gh.io/using-larger-runners (GitHub.com only)
     # Consider using larger runners or machines with greater resources for possible analysis time improvements.
-    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    runs-on: ${{ 'ubuntu-latest' }}
     permissions:
       # required for all workflows
       security-events: write
@@ -69,7 +69,7 @@ jobs:
     - if: matrix.build-mode == 'manual'
       shell: bash
       run: |
-        pip install --break-system-packages -r requirements.txt
+        sudo apt install meson ninja-build python3-pytest
         meson setup build --buildtype=debug
         meson compile -C build