Fix code scanning alerts in codeql action

[aeisenberg]

Tracking issue for:

• https://github.com/github/codeql-action/security/code-scanning/1003
• https://github.com/github/codeql-action/security/code-scanning/1050
• https://github.com/github/codeql-action/security/code-scanning/1166
• https://github.com/github/codeql-action/security/code-scanning/1165
• https://github.com/github/codeql-action/security/code-scanning/1167
• https://github.com/github/codeql-action/security/code-scanning/1168
• https://github.com/github/codeql-action/security/code-scanning/1163
• https://github.com/github/codeql-action/security/code-scanning/1164

[aeisenberg]

@kaeluka since you're shield next week, I am assigning this to you. These are both minor security issues. I believe these are both straight forward to fix, if they are really problems at all. If it turns out they are not easy to fix, please comment here and we will address later. If they are FPs, please close them.

[angelapwen]

First alert is a false positive and I've dismissed.

Second alert is about differing input descriptions across Actions.

• PR to unify the token input: Unify token description for resolve-environment, start-proxy, and upload-sarif #2780. Note that I have a comment about not actually being sure if the start-proxy token description should be unified based off the required token permissions.
• For the language input, I think I will dismiss as wont-fix. For resolve-environment, the description is "The language to infer the build environment configuration for." and for start-proxythe description isThe programming language to setup the proxy for the correct ecosystem`. It seems unnecessarily confusing to make the description something general like "the programming language" just for the sake of resolving the alert 🤔

[angelapwen]

A few more of these popped up over the weekend. I've added them to the list in the issue

[angelapwen]

#2781 for the new code injection warnings

[angelapwen]

#2782 for the new unversioned immutable SHA alerts.

[angelapwen]

All merged!