Fix assumption that all CodeQL bundle URLs contain the tag name of the bundle

[henrymercer]

While implementing controlled switchover, we inadvertently introduced an assumption that all CodeQL bundle URLs contain the tag name of the bundle, for example codeql-bundle-2020230120. This is in fact not the case on GHES, where the bundle URL may be https://example.githubenterprise.com/api/v3/repos/github/codeql-action/releases/assets/1 when the CodeQL sync tool has been used to sync the CodeQL bundle to the GHES instance.

This PR adds a regression test and fixes that assumption.

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Confirm the readme has been updated if necessary.
• Confirm the changelog has been updated if necessary.

[aeisenberg]

I tried to download an untagged dev CLI instance: https://github.com/dsp-testing/aeisenberg-sarif-upload/actions/runs/4106366120/jobs/7084499130 The job failed. Here is the commit sha I am working with (private repository). https://github.com/dsp-testing/aeisenberg-sarif-upload/commit/0576bc5134025ab810bb47a6c6c67ebe1209d707

Note that the failure reason is a 404 during download, which is strange since the URL https://github.com/dsp-testing/codeql-cli-nightlies/releases/download/untagged-9b0f002edc6e08260e8f/codeql-bundle-linux64.tar.gz works for me when I access it from the browser.

[aeisenberg]

OK, So I tried again, but this time with a publicly available CLI version that has a non-standard tag. The download worked, but it looks like the tool wasn't cached in the toolcache. I don't think that's a problem.

[aeisenberg]

Looks good. I've convinced myself that this fix will correctly download codeqls from arbitrary github releases.

[henrymercer]

👍, to summarize:

• Draft releases are not publicly accessible, so the Actions GitHub token did not have access to the bundle from the draft release
• Passing a PAT as the token input to init causes problems since the status API only accepts an Actions PAT
• Working around by publishing the release to make it publicly accessible allows us to download tools from another release.
• If there is no codeql-bundle-* tag in the URL, the bundle does not get cached. We think this is acceptable since (a) we don't yet have reason to recommend this, and (b) we have an internal issue for the more general issue of how we version the CodeQL Bundle that will also fix this.