[csharp] sql injection detection not working?

We are evaluating GHAS for our app sec pipeline and we can't seem to get it to flag for sql injection.

```csharp
public void SubscribeTo(int systemKeyId, ThirdPartyType thirdParty, string userReference)
{

#pragma warning disable SYSLIB0021
#pragma warning disable SCS0010
// this is detected
System.Security.Cryptography.SymmetricAlgorithm serviceProvider = new System.Security.Cryptography.DESCryptoServiceProvider();
#pragma warning restore SCS0010
#pragma warning restore SYSLIB0021

#pragma warning disable CS0618 // Type or member is obsolete
// none of these detected
var adapterA = new SqlCommand("SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + userReference + "' ORDER BY PRICE");
var adapterB = new SqlCommand("SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + userReference + "' ORDER BY PRICE", null);
var adapterC = new SqlCommand("SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='" + userReference + "' ORDER BY PRICE", null, null);
#pragma warning restore CS0618 // Type or member is obsolete

using (var session = _pgDatabase.OpenSession())
using (var transaction = session.BeginTransaction(System.Data.IsolationLevel.ReadCommitted))
{
// this is not detected
session.CreateSQLQuery(@$"insert into thirdpartymonitor.subscription(user_reference, thirdparty_id, system_id) VALUES ('{userReference}', {thirdParty}, {systemKeyId}) ON CONFLICT DO NOTHING;")
.ExecuteUpdate();

transaction.Commit();
}
}
```

I would expect the `SqlCommand` to be detected as per https://github.com/github/codeql/blob/fe18e0e414daa3a5bf5b27ae6690e8c485850d44/csharp/ql/lib/ext/System.Data.SqlClient.model.yml#L6

But I'm not sure if `CreateSQLQuery` is detected as I don't see a sink for nhibernate.CreateSQLQuery?

I've attached my workflow file too.

[codeql.yml](https://github.com/user-attachments/files/24065746/codeql.yml)

Cheers,
Indy

Start with the C# SqlClient model at csharp/ql/lib/ext/System.Data.SqlClient.model.yml and review the attached codeql.yml workflow. Compare the three SqlCommand examples with the SQL injection query behavior, then investigate whether the NHibernate CreateSQLQuery entry point is modeled. Done means the detection behavior and any missing coverage are reproduced and clearly documented.

Written by the indexing model from the issue text.