[actions] Alternate actions/checkout paths suppress untrusted-checkout alerts

Bắt đầu với ActionsMutableRefCheckout.getPath() và ActionsSHACheckout.getPath() trong actions/ql/lib/codeql/actions/security/UntrustedCheckoutQuery.qll, sau đó so sánh chúng với LocalScriptExecutionRunStep.getPath() trong PoisonableSteps.qll. Sử dụng reproducer được liên kết để xác minh sự không khớp hiện tại, thêm coverage hồi quy cho các dạng đường dẫn được liệt kê và xác nhận rằng cả query Critical lẫn High đều báo cáo các trường hợp có đường dẫn thay thế, trong khi immutable checkout vẫn không được báo cáo.

Description of the issue

actions/untrusted-checkout/critical does not report a privileged workflow that checks out an untrusted PR into a non-default path: and then executes a script or local action from that checkout. The actions/untrusted-checkout/high fallback is also suppressed, so neither query reports the workflow.

Minimal reproducer

on: pull_request_target

permissions:
  contents: write

jobs:
  execute:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          repository: ${{ github.event.pull_request.head.repo.full_name }}
          ref: ${{ github.event.pull_request.head.sha }}
          path: candidate
      - run: bash candidate/proof.sh

actions/checkout places path: candidate under $GITHUB_WORKSPACE, so this executes the same checked-out script relationship as a default checkout followed by bash proof.sh.

Reproduction

The complete reproducer is in public fork PR #1.

• Latest-release fork CI: CodeQL Action 4.37.1, CLI 2.26.1, codeql/actions-queries 0.6.31
• Current-main CI: queries compiled directly from github/codeql@14450f5bf38ea9a3ce2e0e45dcf51c0bbdd01af5

Both successful runs scanned all 11 workflow files and produced the same result matrix:

The CI also executed harmless script and composite-action canaries through the tested paths before analysis.

Expected result

The alternate-path cases should be reported by actions/untrusted-checkout/critical, like their default-path controls. A path-representation mismatch should not suppress both the critical query and its high fallback.

Source-level cause

At current main:

• ActionsMutableRefCheckout.getPath() and ActionsSHACheckout.getPath() return explicit checkout paths verbatim.
• LocalScriptExecutionRunStep.getPath() and local-action paths are normalized into GITHUB_WORKSPACE/... form.
• The critical query compares those representations with isSubpath, while the high query suppresses its fallback because the following step is still a PoisonableStep.

Normalizing explicit actions/checkout paths at the checkout model, with regression tests for bare, dot-relative, trailing-slash, and local-action forms, appears to be the smallest fix.