Previously, we uploaded combined SARIF artifacts in both the `analyze-post` and `upload-sarif-post` steps. This change ensures that these artifacts are uploaded at most once — in `analyze-post` if it is a first-party run and `upload-sarif-post` if it is a third-party run.

This is a defensive check because as we upgrade to the new `artifact` dependencies we will not be able to upload artifacts to the same artifact directory.

More accurately describes what these artifacts are, rather than the step they're uploaded in.

Mergeback v3.26.7 refs/heads/releases/v3 into main

Co-authored-by: Andrew Eisenberg <aeisenberg@github.com>

Fix incorrect documentation about the `token` input to the Actions.

The script `.github/update-release-branch.py` uses the `git` command
to push changes. Therefore we need to ensure that `git` authenticates
with a token that has the `workflows` write permision.

This change restore the GitHub token used by the script to access the
API and applies the `workflows` write permission to the token used by `git`.

…cts-upload

Refactor: prepare debug artifacts for `artifact` upgrades

…-for-auth

Use generated token on checkout

…ct-robustness

Improve the robustness of creating and uploading debug artifacts

…nings

Turn URI errors into warnings

Update default bundle to 2.19.0