Address CodeQL findings in dotnet E2E harness

Use Path.Join instead of Path.Combine (never silently drops rooted
arguments) and replace the foreach scan with a LINQ Select +
FirstOrDefault when locating the platform package's index.js.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: stephentoub

dotnet/test/Harness/E2ETestContext.cs

@@ -143,15 +143,14 @@ private static string GetCliPath(string repoRoot)
         // As of CLI 1.0.64-1 the @github/copilot package is a thin loader; the
         // runnable index.js ships in the installed platform package
         // (e.g. @github/copilot-linux-x64). Exactly one is installed.
-        var githubModules = Path.Combine(repoRoot, "nodejs", "node_modules", "@github");
+        var githubModules = Path.Join(repoRoot, "nodejs", "node_modules", "@github");
         if (Directory.Exists(githubModules))
         {
-            foreach (var dir in Directory.EnumerateDirectories(githubModules, "copilot-*"))
-            {
-                var candidate = Path.Combine(dir, "index.js");
-                if (File.Exists(candidate))
-                    return candidate;
-            }
+            var candidate = Directory.EnumerateDirectories(githubModules, "copilot-*")
+                .Select(dir => Path.Join(dir, "index.js"))
+                .FirstOrDefault(File.Exists);
+            if (candidate != null)
+                return candidate;
         }
 
         throw new InvalidOperationException(