Removing first-party entries from trustedActionsOwnerDataModel

I would like to see the ability to _remove_ the first-party orgs from the trustedActionsOwnerDataModel, enabling unpinned warnings on first-party actions. If we're mandating SHA pinning on all external actions but GitHub's actions get overlooked, it leaves a gap in our code scanning.

Current usage:
```yaml
extensions:
- addsTo:
pack: codeql/actions-all
extensible: trustedActionsOwnerDataModel
data:
- ["org1"]
- ["org2"]
```

Potential (psuedocode, not real working examples):
```yaml
extensions:
- addsTo:
pack: codeql/actions-all
extensible: trustedActionsOwnerDataModel
data:
- ["org1"]
- ["org2"]
- ["!github"] # this syntax
- ["!actions"]
- ["!advanced-security"]

- removesFrom: # or this syntax?
pack: codeql/actions-all
extensible: trustedActionsOwnerDataModel
data:
- ["github"]
- ["actions"]
- ["advanced-security"]

- addsTo: # or this?
pack: codeql/actions-all
extensible: distrustedActionsOwnerOverrideDataModel # new
data:
- ["github"]
- ["actions"]
- ["advanced-security"]
```

Start by reviewing the trustedActionsOwnerDataModel extension examples in the issue and how first-party owners are currently represented. Compare the proposed negation, removesFrom, and override approaches, then define which behavior and syntax should be supported. Done means a documented, tested way to remove selected first-party organizations so unpinned warnings can be enabled.

Written by the indexing model from the issue text.