Mergeback v2.1.8 refs/heads/v2 into main

autobuild: add working-directory input

Co-authored-by: Henry Mercer <henrymercer@github.com>

Add codeql-python as CODEOWNERS

Re-enable waiting for processing by default, using the new API semantics.

The process of creating the v1 release can run into merge conflicts. We
commit the unresolved conflicts so a maintainer can easily resolve them
(vs erroring and requiring maintainers to reconstruct the release
manually).

Prepare for renaming `v1` -> `releases/v1` and `v2` -> `releases/v2`.

Bumps [glob](https://github.com/isaacs/node-glob) from 7.1.7 to 8.0.1.
- [Release notes](https://github.com/isaacs/node-glob/releases)
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](isaacs/node-glob@v7.1.7...v8.0.1)

---
updated-dependencies:
- dependency-name: glob
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Bump glob from 7.1.7 to 8.0.1

This check is primarily intended to validate that any merge conflicts in
the v2 -> v1 backport PR are fixed before the PR is merged.

As previously written, if codeql finds a `Pipfile`, but no `Pipfile.lock`, it will run `pipenv install` with args that require `Pipfile.lock` to exist. Pipfile will fail with this message:

```
  Usage: python -m pipenv install [OPTIONS] [PACKAGES]...
  
  ERROR:: Pipfile.lock must exist to use --keep-outdated!
  package installation with pipenv failed, see error above
```

This changeset enables auto_install to work with Pipfile when there is no lock. (Bonus: `--skip-lock` is generally a bit faster.)

Specify releases of the CodeQL Action using tags instead of branches

…ge commit

This gives us slightly messier git history, but more importantly makes
reviewing substantially easier.

Bump default CodeQL version to 2.9.0

git.io is deprecated, so use the full link to docs.github.com instead.

…ts-in-releases

Commit any conflicts during v1 backport to simplify release process

README: Replace git.io shortlink with full link

Fix status reporting error on Windows

Merge main into releases/v2

This reverts commit f679ec9.

This reverts commit c7b049b.

…7502d6e9

# Conflicts:
#	autobuild/action.yml