Verify CodeQL bundle integrity before installation - #1011

This pull request updates the scripts/install-codeql.ps1 script to improve the reliability, security, and maintainability of the CodeQL CLI installation process. The most significant changes include verifying the SHA-256 hash of the downloaded CodeQL bundle, checking for newer CodeQL bundle versions, and improving error handling throughout the script.

Security and Integrity Improvements:

• The script now verifies the SHA-256 hash of the downloaded CodeQL bundle against an expected value to ensure the integrity of the download. If the hash does not match, the installation is aborted. [1] [2]

Version Management Enhancements:

• The script checks if the pinned CodeQL bundle version is older than the latest default version used by the CodeQL Action and warns the user if an update may be needed.

Error Handling Improvements:

• Error handling is improved for all critical operations, including REST API calls, the CodeQL CLI execution, file extraction, and download steps. The script now throws descriptive errors if any major step fails. [1] [2]

General Script Improvements:

• Consistent use of the $InstallDir variable and improved directory management for clarity and correctness.

Submodule Update:

• The mapistub submodule is updated to a new commit.