JavaScript: Pull in changes up to 53548a6024b51

CPP: Fixes for C++: Mishandling Japanese Era and Leap Year in calculations #1354

Java: Add unit test for ldap injection.

* --steps flag to run multiple steps

* README updated

Basic CodeQL extractor configuration and autobuild scripts

Kotlin: Add support for supertypes

Swift: Add swift-security-and-quality, swift-security-extended packs.

Feature selection: Use a shipping model with the new features excluding fileImports and calleeImports. Model #3.

github/ml-ql-adaptive-threat-modeling#1968 (comment)

New features: Shipping model. 9 new features, remove the old ones that have been replaced by new ones. The codeql PR has been rebased on top of main. #3

https://ml.azure.com/experiments/id/85e6e910-7301-4441-9079-01a1e42fd45b/runs/classification_1662479795_acd730eb?wsid=/subscriptions/91095667-e119-4555-acea-1826488492f0/resourceGroups/atm-codeml/providers/Microsoft.MachineLearningServices/workspaces/ATM-workspace&tid=398a6654-997b-47e9-b12b-9515b896b4de

New features: Shipping model. 9 new features, remove the old ones that have been replaced by new ones. The codeql PR has been rebased on top of main. #3 (with a fixed package version)

https://ml.azure.com/experiments/id/85e6e910-7301-4441-9079-01a1e42fd45b/runs/classification_1662479795_acd730eb?wsid=/subscriptions/91095667-e119-4555-acea-1826488492f0/resourceGroups/atm-codeml/providers/Microsoft.MachineLearningServices/workspaces/ATM-workspace&tid=398a6654-997b-47e9-b12b-9515b896b4de

New features: Shipping model. 9 new features, remove the old ones that have been replaced by new ones. The codeql PR has been rebased on top of main. #3 (with a fixed package version)

https://ml.azure.com/experiments/id/85e6e910-7301-4441-9079-01a1e42fd45b/runs/classification_1662479795_acd730eb?wsid=/subscriptions/91095667-e119-4555-acea-1826488492f0/resourceGroups/atm-codeml/providers/Microsoft.MachineLearningServices/workspaces/ATM-workspace&tid=398a6654-997b-47e9-b12b-9515b896b4de

New features: Shipping model. 9 new features, remove the old ones that have been replaced by new ones. The codeql PR has been rebased on top of main. #3 (with a fixed package version)

https://ml.azure.com/experiments/id/85e6e910-7301-4441-9079-01a1e42fd45b/runs/classification_1662479795_acd730eb?wsid=/subscriptions/91095667-e119-4555-acea-1826488492f0/resourceGroups/atm-codeml/providers/Microsoft.MachineLearningServices/workspaces/ATM-workspace&tid=398a6654-997b-47e9-b12b-9515b896b4de

C++: Use refactored dataflow library in `cpp/command-line-injection`

Swift: Syntax for selecting `PostUpdateNode`s in CSV rows

C++: Fix expected test results

Add support for external definitions

Move language-agnostic model to shared library

When CODEQL_EXTRACTOR_GO_OPTION_EXTRACT_TESTS=true is set, the Go
extractor was incorrectly skipping internal test files (package foo)
at repository roots when the project contains nested test packages.

Root Cause:
The extractor selected package variants by longest ID string, but this
heuristic fails when nested packages have tests. For a package like
"github.com/go-git/go-git/v6", packages.Load returns multiple variants:

1. "github.com/go-git/go-git/v6" (19 files, production only)
2. "github.com/go-git/go-git/v6 [github.com/go-git/go-git/v6.test]"
   (39 files, production + 20 root tests) ← Should select this
3. "github.com/go-git/go-git/v6 [github.com/go-git/go-git/v6/plumbing/format/packfile.test]"
   (19 files, test dependency) ← Was incorrectly selected (longest string)

The old logic selected variant #3 (76 chars) over #2 (68 chars),
causing 20 root test files to be missing from the database.

Fix:
Replace string length comparison with a better heuristic that prefers:
1. Exact test packages (e.g., "pkg [pkg.test]") over nested dependencies
2. Packages with more Syntax nodes (more files to extract)
3. String length as a tiebreaker

This ensures the extractor selects the variant with the most complete
test coverage, particularly for root-level internal tests.

Testing:
- Added comprehensive unit tests covering the selection logic
- Tests simulate the real-world go-git scenario
- All tests pass

Impact:
Root-level external tests (package foo_test) were already extracted
correctly. This fix ensures internal tests (package foo) at the root
are now also extracted when they exist alongside nested test packages.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>