Entra ID as SAML IdP Causes CodeQL to Fail with Self-Signed Certificate Found in Certificate Chain

### Environment

- GHES 3.13.0 on Azure VM STIGd to 98% (working fine)
- EntraID SAML setup for GitHub
**NOTE: Tried OIDC however GitHub 3.13.0 goes to the Azure commercial endpoints and not the government ones.**
**NOTE: If trying to send GH audit to EventHub, same issue. GH 3.13.0 defaults to commercial endpoints and not government**
- Configured SAML on GH and verify working fine including hydrating additional claims for GH admins and GH users

### Expectation

- CodeQL executes honoring the certificate chain presented by the GitHub server for CodeQL

### Problem

- Self-Signed certificate found in chain:

### Additional Comments / Notes

Cross-Reference for some additional context: https://security.stackexchange.com/questions/146132/self-signed-certificate-for-a-idp-initiated-saml-sso

When executing on my Windows 2022 CodeQL Server:

`.\openssl s_client -showcerts -connect :443`

shows the self-signed certificate in the chain:

```
Server certificate
subject=*****redacted*****, CN=
issuer=*****redacted***** Pointing to VALID root and in certificate store and verifed *****
---
No client certificate CA names sent
Peer signing digest: *****redacted*****
Peer signature type: *****redacted*****
Server Temp Key: *****redacted*****
---
SSL handshake has read 4630 bytes and written 395 bytes
Verification error: self-signed certificate in certificate chain
---
New, TLSv1.3, Cipher is *****redacted*****
Server public key is *****redacted*****
This TLS version forbids renegotiation.
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 19 (self-signed certificate in certificate chain)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
Protocol : TLSv1.3
Cipher : *****redacted*****
Session-ID:*****redacted*****
Session-ID-ctx:
Resumption PSK: *****redacted*****
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 7200 (seconds)
TLS session ticket: *****redacted*****

Start Time:*****redacted*****
Timeout : 7200 (sec)
Verify return code: 19 (self-signed certificate in certificate chain)
Extended master secret: no
Max Early Data: 0
---
```

Aucun fichier du dépôt ni aucun test n’est identifié ; commencez par la configuration Entra ID SAML et GHES 3.13.0 décrite, puis reproduisez la vérification Windows 2022 CodeQL Server à l’aide de la commande openssl s_client fournie. Le travail est terminé lorsqu’il est déterminé pourquoi le certificat autosigné apparaît dans la chaîne et qu’il est établi que CodeQL respecte la chaîne de certificats valide du serveur GitHub.

Rédigé par le modèle d'indexation à partir du texte de l'issue.