Unpin CodeQL pack dependencies by removing committed lock files

[Copilot]

📝 Query Update

• Query File: N/A — repository-wide pack configuration change
• Language: all (actions, cpp, csharp, go, java, javascript, python, ruby)
• Update Type: dependency unpinning

🎯 Changes

What Changed

• Deleted all 32 committed codeql-pack.lock.yml files under languages/<lang>/{custom,tools}/{src,test}/.
• Added codeql-pack.lock.yml to .gitignore so locally generated lock files are not re-committed.
• No changes to qlpack.yml files — they already declare codeql/*-all (and *-queries) as "*".

Why This Change

Committed lock files pinned packs to old versions (e.g. codeql/java-all 7.7.0), blocking template consumers from using features tied to newer libraries — for example, the barrierModel extensible predicate, which requires codeql/java-all shipped with CodeQL 2.25.2+.

Impact

Consumers of this template generate their own codeql-pack.lock.yml on codeql pack install, resolving against whichever CodeQL CLI they have installed. The template no longer dictates a CodeQL version floor/ceiling.

🔍 Before vs. After

Previous Behavior

codeql-pack.lock.yml checked into the repo pinned every transitive dependency, e.g.:

dependencies:
  codeql/java-all:
    version: 7.7.0

New Behavior

Only qlpack.yml is tracked, with floating versions:

dependencies:
  codeql/java-all: "*"

Lock files are produced locally per consumer and ignored by git.

🧪 Testing

• New/updated test cases added
• All tests pass
• Regression tests validated
• No unintended side effects

📊 Impact Analysis

• Compatibility: backward compatible for consumers on a recent CodeQL CLI; consumers on very old CLIs may resolve different (newer) library versions than before
• Performance: neutral
• Accuracy: unchanged at the query level; unblocks adoption of newer library features (e.g. sanitizer/validator MaD, barrierModel)

📋 Checklist

• Query compiles without errors
• Documentation updated
• Tests updated with new expectations
• Metadata updated if needed

🔗 References

• GitHub Changelog: CodeQL now supports sanitizers and validators in models as data
• Related: Add data extension prompts, templates, and barrier/barrierGuard support #42