C#: Start using CSV based flow models

[tamasvajk]

This PR

• migrates some sources, steps, and sinks to the new CSV format;
• adjusts the coverage report generators and workflows to cover C# too;
• modifies the RST generator to allow specifying multiple sink ids per CWE number.

The workflows have been tested here:

• PR commenter: https://github.com/dsp-testing/codeql-csv-coverage-pr-commenter/pull/12#issuecomment-868509528
• Timeseries: run run
• Report updater: PR with commit

[tamasvajk]

We can't express getAnOverrider* in CSV, but anyways, HttpResponse is sealed.

[tamasvajk]

The PR was rebased to fix merge conflicts.

[github-actions]

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged. The following differences were found:

java

Generated file changes for java

• Changes to framework-coverage-java.rst:

-    Framework / library,Package,Remote flow sources,Taint & value steps,Sinks (total),`CWE‑022` :sub:`Path injection`,`CWE‑036` :sub:`Path traversal`,`CWE‑079` :sub:`Cross-site scripting`,`CWE‑089` :sub:`SQL injection`,`CWE‑090` :sub:`LDAP injection`,`CWE‑094` :sub:`Code injection`,`CWE‑319` :sub:`Cleartext transmission`
+    Framework / library,Package,Flow sources,Taint & value steps,Sinks (total),`CWE‑022` :sub:`Path injection`,`CWE‑036` :sub:`Path traversal`,`CWE‑079` :sub:`Cross-site scripting`,`CWE‑089` :sub:`SQL injection`,`CWE‑090` :sub:`LDAP injection`,`CWE‑094` :sub:`Code injection`,`CWE‑319` :sub:`Cleartext transmission`

[tamasvajk]

The comment #6148 (comment) is specific to this PR. main and this branch produce different CSV files, so the changes are shown on the PR.

The "remote vs all flows" change will generate some noise on other PRs too: PRs that were opened before this change will report different coverage files in the previous run of the job than in the current one, so a comment will be added to them. (Usually the comment that a recent change removed a previously reported coverage change will be added.)

[hvitved]

Approach LGTM. Thanks for starting this work Tamas.