We can save time installing the bundle by streaming the download and extraction phases, so that CPU time previously spent waiting on the network can now be spent extracting what we've received so far.

Some implementation notes:

• Streaming is enabled behind a feature flag.

• We implement streaming only for Zstandard so that in the event of a bug with streaming, we can fallback to a download first then extract method.

• The Actions toolkit HTTP client downloads the full response body, so we can't use it to stream the extraction. Therefore, we use the lower-level Node APIs. But these don't handle redirects, so we add a dependency on follow-redirects to avoid implementing error-prone redirect handling ourselves.

• We add some performance measurements so we can see how much faster streaming is compared to downloading first then extracting.

• This PR also adds some logging improvements to the setup CodeQL step, removing the verbose tar extraction output, and only echoing commands for which we're streaming the output.

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Confirm the readme has been updated if necessary.
• Confirm the changelog has been updated if necessary.