[actions] Alternate actions/checkout paths suppress untrusted-checkout alerts

**Description of the issue**

`actions/untrusted-checkout/critical` does not report a privileged workflow that checks out an untrusted PR into a non-default `path:` and then executes a script or local action from that checkout. The `actions/untrusted-checkout/high` fallback is also suppressed, so neither query reports the workflow.

## Minimal reproducer

```yaml
on: pull_request_target

permissions:
contents: write

jobs:
execute:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
with:
repository: ${{ github.event.pull_request.head.repo.full_name }}
ref: ${{ github.event.pull_request.head.sha }}
path: candidate
- run: bash candidate/proof.sh
```

`actions/checkout` places `path: candidate` under `$GITHUB_WORKSPACE`, so this executes the same checked-out script relationship as a default checkout followed by `bash proof.sh`.

## Reproduction

The complete reproducer is in [public fork PR #1](https://github.com/1sgtpepper/codeql-actions-checkout-path-repro/pull/1).

- [Latest-release fork CI](https://github.com/1sgtpepper/codeql-actions-checkout-path-repro/actions/runs/29674597314): CodeQL Action 4.37.1, CLI 2.26.1, `codeql/actions-queries` 0.6.31
- [Current-main CI](https://github.com/1sgtpepper/codeql-actions-checkout-path-repro/actions/runs/29674930303): queries compiled directly from `github/codeql@14450f5bf38ea9a3ce2e0e45dcf51c0bbdd01af5`

Both successful runs scanned all 11 workflow files and produced the same result matrix:

| Case | Result |
|---|---|
| Default checkout followed by `bash proof.sh` | `actions/untrusted-checkout/critical` |
| Default checkout followed by `uses: ./.github/actions/proof` | `actions/untrusted-checkout/critical` |
| Default checkout with quoted or `$GITHUB_WORKSPACE` script paths | `actions/untrusted-checkout/critical` |
| `path: candidate`, `./candidate`, or `candidate/` followed by the corresponding script | no critical or high alert |
| `path: candidate` followed by `uses: ./candidate/.github/actions/proof` | no critical or high alert |
| Immutable checkout control | no critical or high alert |

The CI also executed harmless script and composite-action canaries through the tested paths before analysis.

## Expected result

The alternate-path cases should be reported by `actions/untrusted-checkout/critical`, like their default-path controls. A path-representation mismatch should not suppress both the critical query and its high fallback.

## Source-level cause

At current `main`:

- [`ActionsMutableRefCheckout.getPath()` and `ActionsSHACheckout.getPath()` return explicit checkout paths verbatim](https://github.com/github/codeql/blob/14450f5bf38ea9a3ce2e0e45dcf51c0bbdd01af5/actions/ql/lib/codeql/actions/security/UntrustedCheckoutQuery.qll#L260-L299).
- [`LocalScriptExecutionRunStep.getPath()` and local-action paths are normalized into `GITHUB_WORKSPACE/...` form](https://github.com/github/codeql/blob/14450f5bf38ea9a3ce2e0e45dcf51c0bbdd01af5/actions/ql/lib/codeql/actions/security/PoisonableSteps.qll#L39-L56).
- [The critical query compares those representations with `isSubpath`](https://github.com/github/codeql/blob/14450f5bf38ea9a3ce2e0e45dcf51c0bbdd01af5/actions/ql/src/Security/CWE-829/UntrustedCheckoutCritical.ql#L23-L46), while [the high query suppresses its fallback because the following step is still a `PoisonableStep`](https://github.com/github/codeql/blob/14450f5bf38ea9a3ce2e0e45dcf51c0bbdd01af5/actions/ql/src/Security/CWE-829/UntrustedCheckoutHigh.ql#L21-L24).

Normalizing explicit `actions/checkout` paths at the checkout model, with regression tests for bare, dot-relative, trailing-slash, and local-action forms, appears to be the smallest fix.

Start with ActionsMutableRefCheckout.getPath() and ActionsSHACheckout.getPath() in actions/ql/lib/codeql/actions/security/UntrustedCheckoutQuery.qll, then compare them with LocalScriptExecutionRunStep.getPath() in PoisonableSteps.qll. Use the linked reproducer to verify the current mismatch, add regression coverage for the listed path forms, and confirm both critical and high queries report the alternate-path cases while immutable checkout remains unreported.

Escrita pelo modelo de indexação a partir do texto da issue.