Actions: Normalize explicit untrusted checkout paths

[1sgtpepper]

Fixes #22213.

Summary

• Normalize explicit relative actions/checkout paths before comparing them with local script and action paths.
• Add behavioral coverage for bare, ./, trailing-slash, nested, and workflow_run path cases.
• Add a change note for the new critical-query results.

Root cause

Local script and action paths use the shared GITHUB_WORKSPACE/ representation, while explicit checkout paths were compared verbatim. Equivalent paths therefore failed the critical-query subpath check.

Reproduction: 1sgtpepper/codeql-actions-checkout-path-repro#2.

Impact

actions/untrusted-checkout/critical now reports privileged workflows that execute code from an explicitly named checkout directory. Checkout paths that are already absolute or expression-based retain the existing normalization behavior.

Validation

• codeql test run --search-path=. -j=0 -- actions/ql/test/query-tests/Security/CWE-829 (8/8 passed)
• codeql query format --check-only -- actions/ql/lib/codeql/actions/security/UntrustedCheckoutQuery.qll
• git diff --check

The .expected update was generated with codeql test run --learn.