ci: handle SARIF polling disabled errors

[haasonsaas]

Summary

• share Code Scanning disabled-error handling between the SARIF upload request and SARIF processing poll
• return cleanly when the polling endpoint reports Code Scanning is disabled
• add focused tests for disabled and non-disabled HTTP errors

Test

• uv tool run black scripts/upload-sarif-to-code-scanning.py tests/test_upload_sarif_to_code_scanning.py
• uv tool run pytest tests/test_upload_sarif_to_code_scanning.py
• python -m py_compile scripts/upload-sarif-to-code-scanning.py tests/test_upload_sarif_to_code_scanning.py

Note: local pre-commit was skipped because the installed macOS bash 3.2 lacks mapfile used by the hook; this change has no staged Go files and Python checks above passed.

Fixes missed review feedback from #67.

[cursor]

PR Summary

Low Risk
Low risk: small error-handling refactor in a CI helper script plus new unit tests; behavior only changes for specific 403 "code scanning disabled" responses.

Overview
Refactors SARIF upload error handling into shared helpers (is_code_scanning_disabled_error/handle_code_scanning_http_error) and reuses them for both the initial upload request and the subsequent processing-status polling.

When GitHub returns a 403 indicating Code Scanning/Advanced Security is disabled, the script now exits cleanly with a GitHub Actions warning instead of failing during polling; all other HTTP errors still surface the response body on stderr and are re-raised.

Adds focused tests covering the skip-on-disabled behavior and the re-raise path for non-disabled HTTP errors.

^{Reviewed by Cursor Bugbot for commit a84dfb0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Misleading return type creates latent UnboundLocalError risk
  • Updated the helper to return Literal[True] and removed the fragile false-branch handling at both call sites so unbound variables cannot be reached.

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit a84dfb0. Configure here.}