LGTM.com - Missing Vulnerability Path Steps in LGTM render

**Description of the false positive**

I've encountered a few cases where LGTM and the VS Code plugin won't correctly render path steps. It's my hunch that this may be related to when `additionalTaintSteps` are duplicated, ie. are both captured in the CSV model, and in a CodeQL query in directly. It seems when this happens, one path gets generated without this double represented element, and one path does get generated.

- https://github.com/github/codeql/blob/ef0ea247c40da805efa427a37f5213457d18f714/java/ql/src/Security/CWE/CWE-022/ZipSlip.ql#L69-L72
- https://github.com/github/codeql/blob/811a2c005304dfa61220b53142cc127ba28a6538/java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll#L333-L334

**URL to the alert on the project page on LGTM.com**

Example: there are two paths, the first one is only 6 steps, and is missing the critical `new File` call, the second, longer path with 7 steps is correct.
https://lgtm.com/projects/g/apache/ace/snapshot/dbdba56171c187ef5f7796afe5245f7224c86169/files/org.apache.ace.client.workspace/src/org/apache/ace/client/workspace/impl/DPHelper.java?sort=name&dir=ASC&mode=heatmap#L101