Merge main into v1

Merge main into v1

…t-pip-v1

Prevent accidental analysis of the `get-pip.py` script. [v1 cherry-pick]

Merge main into v1

Merge main into v1

Merge main into v1

Merge main into v1

Merge main into v1

Merge main into v1

Merge main into v1

Merge main into v1

Merge main into v1

Merge main into v1

Merge main into v1

Merge main into v1

Merge main into v1

Merge main into v1

Merge main into v1

…s: latest`

Always test against both the default and latest CodeQL bundle.

This improves test coverage shortly after a CodeQL bundle release, where the latest bundle
may not yet be built into the Actions VM image as the default bundle.

It also saves a manual step during bundle release testing,
since we no longer need to temporarily change the PR checks to `tools: latest`.

There is some redundancy when the latest bundle is the same as the default bundle on the VM image,
but this can be considered a test for the `tools: latest` configuration.

Create a prerequisite job that runs the init step twice, with `tools: null` and `tools: latest`.
Use the outputs of these steps to compare the two CodeQL versions.
Pass the list of distinct tool versions for the integration tests to use in their matrix strategy.
This avoids redundant test jobs when the default and latest bundles are actually the same version of CodeQL.

`~` is accepted by JSON but not by the Actions context language, so we use `null` to indicate the default version.

Create a prerequisite job that runs the init step twice, with `tools: null` and `tools: latest`.
Use the outputs of these steps to compare the two CodeQL versions.
Pass the list of distinct tool versions for the analysis job to matrix over.
This lets us test the analysis against both versions, while avoiding duplication
when they are actually the same version.

This allows users to specify a different token for retrieving the
codeql config from a different repository.

Fixes github/advanced-security-field#185

Merge main into v1

Merge main into v1

Merge main into v1

Merge main into v1

Merge main into v1

Merge main into v1

Merge main into v1

Merge main into v1

Merge main into v1

Merge main into v1

Minor change.

Merge main into v1

We need to tag and mergeback if the tag does _not_ already exist.

This should have happened in a mergeback PR, but the workflow to
generate this was broken.

The removeNPMAbsolutePaths check requires no newlines at the
end of the file. This ensures that the version update mimics
the behavior.