actions: drop lockfile-extension generator from unpinned-tag PR

Removes the Go lockfile-extension-generator tool and its extractor autobuild
hook, keeping this PR to its intended discussion scope: the $/ self-repository
suppression plus the QL seam (pinnedByLockfileDataModel extensible predicate and
the not pinnedByLockfile(...) clause).

Parsing actions.lock and populating the predicate is extractor-team work on the
CodeQL CLI cycle, and the tool here reimplemented the canonical parser at
github.com/github/actions-lockfile rather than depending on it, so it would
drift. It also wrote a model pack into the database that CodeQL does not
auto-apply, so it never took effect without extra analysis flags. Better to
scaffold the seam and let the extractor own population.

Reverts the additions to actions/extractor/tools/autobuild.sh and deletes
actions/extractor/tools/generate-lockfile-extension.sh and
actions/extractor/tools/lockfile-extension-generator/. Query behavior and test
expected output are unchanged; the CWE-829 query tests still pass.

Author: nodeselector

actions/extractor/tools/autobuild.sh

@@ -37,11 +37,6 @@ else
     export LGTM_INDEX_FILTERS
 fi
 
-# Capture the source root before handing off to the JavaScript autobuilder,
-# which may change the working directory. The Actions extractor runs from the
-# source root, so `pwd` here is the root of the repository being analysed.
-ACTIONS_SRC_ROOT="$(pwd)"
-
 # Find the JavaScript extractor directory via `codeql resolve extractor`.
 CODEQL_EXTRACTOR_JAVASCRIPT_ROOT="$("${CODEQL_DIST}/codeql" resolve extractor --language javascript)"
 export CODEQL_EXTRACTOR_JAVASCRIPT_ROOT
@@ -60,12 +55,3 @@ env CODEQL_EXTRACTOR_JAVASCRIPT_DIAGNOSTIC_DIR="${CODEQL_EXTRACTOR_ACTIONS_DIAGN
     CODEQL_EXTRACTOR_JAVASCRIPT_TRAP_DIR="${CODEQL_EXTRACTOR_ACTIONS_TRAP_DIR}" \
     CODEQL_EXTRACTOR_JAVASCRIPT_WIP_DATABASE="${CODEQL_EXTRACTOR_ACTIONS_WIP_DATABASE}" \
     "${JAVASCRIPT_AUTO_BUILD}"
-
-# Generate the lockfile-pinned data extension from the repository's Actions
-# lockfile, if present. This is a no-op for repositories without a lockfile.
-GENERATE_LOCKFILE_EXTENSION="$(CDPATH= cd "$(dirname "$0")" && pwd)/generate-lockfile-extension.sh"
-if [ -x "${GENERATE_LOCKFILE_EXTENSION}" ]; then
-    echo "Generating lockfile-pinned data extension."
-    "${GENERATE_LOCKFILE_EXTENSION}" "${ACTIONS_SRC_ROOT}" || \
-        echo "Lockfile-pinned data extension generation failed; continuing without it." >&2
-fi