codeql: use extended query pack

[mdtro]

This expands CodeQL to cover more potentially vulnerable code paths.

In addition to the current detections, this will add detections for:

> github/codeql/java/ql/src/Security/CWE/CWE-079/AndroidWebViewSettingsEnabledJavaScript.ql
> github/codeql/java/ql/src/Security/CWE/CWE-079/AndroidWebViewAddJavascriptInterface.ql
> github/codeql/javascript/ql/src/Security/CWE-117/LogInjection.ql
> github/codeql/javascript/ql/src/Security/CWE-384/SessionFixation.ql
> github/codeql/javascript/ql/src/Security/CWE-400/RemotePropertyInjection.ql
> github/codeql/javascript/ql/src/Security/CWE-078/IndirectCommandInjection.ql
> github/codeql/javascript/ql/src/Security/CWE-020/MissingRegExpAnchor.ql
> github/codeql/javascript/ql/src/Security/CWE-020/MissingOriginCheck.ql
> github/codeql/javascript/ql/src/Security/CWE-313/PasswordInConfigurationFile.ql
> github/codeql/javascript/ql/src/Security/CWE-912/HttpToFileAccess.ql
> github/codeql/javascript/ql/src/Security/CWE-200/FileAccessToHttp.ql
> github/codeql/javascript/ql/src/Security/CWE-807/ConditionalBypass.ql
> github/codeql/javascript/ql/src/Security/CWE-094/UnsafeCodeConstruction.ql
> github/codeql/javascript/ql/src/Security/CWE-1275/SameSiteNoneCookie.ql
> github/codeql/javascript/ql/src/Security/CWE-918/ClientSideRequestForgery.ql
> github/codeql/javascript/ql/src/Security/CWE-377/InsecureTemporaryFile.ql
> github/codeql/javascript/ql/src/Security/CWE-862/EmptyPasswordInConfigurationFile.ql
> github/codeql/javascript/ql/src/Security/CWE-506/HardcodedDataInterpretedAsCode.ql
> github/codeql/javascript/ql/src/Security/CWE-367/FileSystemRace.ql

The query logic can be found here: https://github.com/github/codeql/tree/codeql-cli/v2.15.2/javascript/ql/src/Security