Rule tags in SARIF file exceed limits

Originally reported [here](https://github.com/orgs/community/discussions/144318). I thought I had fixed it by deleting all previous scans and isolating codeql to its own action, but it's come back in multiple repos

### Question

I'm working on [MAPIStubLibrary](https://github.com/microsoft/MAPIStubLibrary). On my security tab, I've got a warning:
`Code scanning: one or more analysis tools are reporting problems
CodeQL is reporting warnings. Check the [status page](https://github.com/microsoft/MAPIStubLibrary/security/code-scanning/tools/CodeQL/status/configurations/api/74a8c85dff2dda02661ba4c491e7edc7db4d2491e021ce53e5df7e05ec472af1) for help.`

When I follow that link, I see this:
`Rule tags in SARIF file exceed limits
The rule SM01718 in an uploaded SARIF file had 11 tags which is more than our limit of 10. Only 10 tags were stored for that rule, the additional ones were ignored.`

`You can edit the @tags metadata property of your query and remove some tags.`

`[Learn more about CodeQL query metadata](https://codeql.github.com/docs/writing-codeql-queries/metadata-for-codeql-queries/).
[Learn more about limits in SARIF uploads](https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning#validating-your-sarif-file).`

But there are no details about what SARIF file caused this problem, or how I could go about locating this file. I can't even identify which action is supposed to have generated this broken file.

As far as I'm aware, actions generate SARIF files, but they "upload" them to some nebulous location github where no one can actually view them. I've never actually seen a SARIF file myself. I tried configuring an action to SARIF files to artifacts but got a file sharing violation. The documentation on SARIF result limits does list this warning but has no prescriptive guidance on dealing with it.

So - **what am I actually supposed to do about this warning?** How do I determine which action is triggering it? Is there some way to see the SARIF files we're generating in our actions so we can try to analyze why they may be triggering the warning?

Screenshot of the warning:
When I click on last scan it just takes me to a commit. Under the ... I have an option to "Download list of rules used" which gives me a file that looks like this:
Configuration,Rule Source,Sarif Identifier,Alerts
"",CodeQL (2.19.2),SM01718,0
"",CodeQL (2.19.2),SM01733,0
"",CodeQL (2.19.2),SM01921,0
"",CodeQL (2.19.2),SM01922,0
"",CodeQL (2.19.2),SM01923,0
...
I can't find SM01718 anywhere else on the internet, except it's also the same rule being reported for [MFCMAPI](https://github.com/microsoft/mfcmapi)

Commencez par la documentation sur les métadonnées des requêtes CodeQL et sur la limite d’envoi SARIF liée dans l’issue, puis étudiez le workflow CodeQL et la page d’état de l’analyse pour la règle SM01718. Reproduisez l’avertissement dans les repositories concernés ou suivez-en la trace, et déterminez comment identifier l’action qui le génère ainsi que le fichier SARIF. Le travail est considéré comme terminé lorsque la documentation fournit aux utilisateurs des étapes concrètes pour trouver la source et inspecter le fichier.

Rédigé par le modèle d'indexation à partir du texte de l'issue.