Add a PR check to validate that ML-powered queries are run correctly

[henrymercer]

Based on #1010.

This PR adds a check to ensure that ML-powered queries are run correctly:

• On Linux and macOS, validate that:
  • The four ML-powered queries appear in the rules of the SARIF output
  • At least one of these queries generates an alert with a score on a test database
• On Windows, validate that:
  • None of the four ML-powered queries appear in the rules of the SARIF output
  • No alerts are generated by ML-powered queries on a test database (admittedly this is a little redundant with the prior check)

Example run: https://github.com/github/codeql-action/actions/runs/2066597691

We should add these jobs to the branch protection rules immediately before merging this PR.

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Confirm the readme has been updated if necessary.
• Confirm the changelog has been updated if necessary.

[henrymercer]

Branch protection rules updated to incorporate these new PR checks.