Support Pipfile without Pipfile.lock

[kojiromike]

As previously written, if codeql finds a Pipfile, but no Pipfile.lock, it will run pipenv install with args that require Pipfile.lock to exist. Pipfile will fail with this message:

  Usage: python -m pipenv install [OPTIONS] [PACKAGES]...
  
  ERROR:: Pipfile.lock must exist to use --keep-outdated!
  package installation with pipenv failed, see error above

This changeset enables auto_install to work with Pipfile when there is no lock. (Bonus: --skip-lock is generally a bit faster.)

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Confirm the readme has been updated if necessary.
• Confirm the changelog has been updated if necessary.

[RasmusWL]

Thanks @kojiromike 👍 I rewrote it a bit. I looked at adding a test for this, but the current test setup is a bit too inflexible 😬 (but I did test locally)

[kojiromike]

Thanks @RasmusWL! Please let me know if there's anything else I can do to help.

[kojiromike]

@RasmusWL sorry to bug you, but should I continue to keep the branch updated, or just wait for someone from codeql-action-reviewers to get back to this PR?

[cklin]

Thank you for the fix!

[RasmusWL]

@RasmusWL sorry to bug you, but should I continue to keep the branch updated, or just wait for someone from codeql-action-reviewers to get back to this PR?

Thanks for your work on this, and your continued effort to keep the branch up to date. I would have not have expected you to put in this effort. Once someone from github/codeql-action-reviewers had given the final review, I would have expected them to use the button on this PR page to merge in newest version of default branch (main), and then enable auto-merge.