Actions: Normalize explicit untrusted checkout paths

[1sgtpepper]

Fixes #22213.

Summary

• Normalize static relative actions/checkout paths before comparing them with local script and action paths.
• Use query-local component-aware containment for those paths so sibling directories remain excluded.
• Add focused coverage for bare, ./, trailing-slash, nested, local-action, opposite-branch, and workflow_run cases.

Root cause

Local script and action paths use the shared GITHUB_WORKSPACE/ representation, while explicit checkout paths were compared verbatim. Equivalent paths therefore failed the critical-query containment check.

Reproduction: 1sgtpepper/codeql-actions-checkout-path-repro#2.

Validation

• codeql test run actions/ql/test/query-tests/Security/CWE-829 --threads=0 (8/8 passed)
• Adjacent direct-cache and poisonable-step tests (2/2 passed)
• codeql query format --check-only for the changed QL file
• git diff --check

The .expected update was generated with codeql test run --learn and verified with a non-learning run.