Removing first-party entries from trustedActionsOwnerDataModel

I would like to see the ability to _remove_ the first-party orgs from the trustedActionsOwnerDataModel, enabling unpinned warnings on first-party actions. If we're mandating SHA pinning on all external actions but GitHub's actions get overlooked, it leaves a gap in our code scanning.

Current usage:
```yaml
extensions:
- addsTo:
pack: codeql/actions-all
extensible: trustedActionsOwnerDataModel
data:
- ["org1"]
- ["org2"]
```

Potential (psuedocode, not real working examples):
```yaml
extensions:
- addsTo:
pack: codeql/actions-all
extensible: trustedActionsOwnerDataModel
data:
- ["org1"]
- ["org2"]
- ["!github"] # this syntax
- ["!actions"]
- ["!advanced-security"]

- removesFrom: # or this syntax?
pack: codeql/actions-all
extensible: trustedActionsOwnerDataModel
data:
- ["github"]
- ["actions"]
- ["advanced-security"]

- addsTo: # or this?
pack: codeql/actions-all
extensible: distrustedActionsOwnerOverrideDataModel # new
data:
- ["github"]
- ["actions"]
- ["advanced-security"]
```

先查看 issue 中的 trustedActionsOwnerDataModel 擴充範例，以及目前如何表示 first-party owner。比較提議的 negation、removesFrom 和 override 方法，然後定義應支援的行為和語法。當有一種經過文件說明和測試的方法，可以移除選定的 first-party 組織，從而啟用 unpinned 警告時，即表示完成。

由索引模型根據 Issue 內容生成。