[ci] modify CodeQL settings

[jameslamb]

For the last few days, we've observed 2 CI issues which happen on every build triggered by a merge to master... but which do not happen on PRs.

• runtime error: member call on address 0x612000003ad8 which does not point to an object of type 'std::streambuf' in macOS cpp_tests CI job #6543
• OSError: [WinError 122] The data area passed to a system call is too small in Windows bdist CI job #6544

Comparing logs between those types of builds, I found only 1 seemingly-significant difference between them... on builds triggered by merges to master, tasks called Initialize CodeQL and Finalize CodeQL are automatically injected.

This proposes trying to prevent those tasks from being injected. If we do that and see a few builds on master succeed, we'll be able to say with confidence that the CodeQL jobs were the issue.

More context on how these jobs might cause the CI failures we've observed #6544 (comment)

Notes for Reviewers

Docs on where this comes from or how to turn it off?

I couldn't really find any. "Configure GitHub Advanced Security for Azure DevOps" (Azure DevOps docs) describes how to enable this scanning, but does not talk about auto-injection.

The variables I'm proposing adding to .vsts-ci.yml were found in other large projects' configs:

• dotnet/roslyn (link)
• dotnet/sourcelink (link)
• interpretml/interpret (link)
• Microsoft/STL (link)
• posit-dev/positron (link)

I'm not sure how those projects learned about them... I haven't yet found any documentation referencing them.

This is not the first time we've had to do something like this ... @StrikerRUS I remembered you something very similar back in November 2022: #5175.

How to test this

The only way to test this is to merge to master, as this behavior is only observable there.

[borchero]

Let's give it a try 👀

[jameslamb]

I think this worked?

0 CodeQL tasks were injected, and all of the CI jobs passed on the first attempt (for the first time in a few weeks) 🎉

build link: https://dev.azure.com/lightgbm-ci/lightgbm-ci/_build/results?buildId=16698&view=logs&j=ea56812e-e7ae-55d0-6abc-4a217857fa9f

I strongly suspect that those CodeQL jobs were causing the issues we observed in #6543 and #6544.