3.19.1.kata3

What's Changed

• ci: Delete codeql.yml by @manuelh-dev in #390
• Re-add codeql.yml with proper branches by @manuelh-dev in #391
• Revert "runtime: fix error when using the debug console" by @manuelh-dev in #388
• node-builder: fix typo in string comparison by @sprt in #392
• docs: node-builder: fix static check error by @sprt in #394
• runtime: fix make test by @sprt in #393
• docs: node-builder: Remove references to moby-containerd-cc by @manuelh-dev in #399
• Cherry pick static-checks fixes from upstream by @sprt in #398
• runtime: Enforce that OCI memory limit exceeds configurable 128MB baseline by @Camelron in #389
• runtime: Set disable_image_nvdimm=true to disable pmem by @Camelron in #402
• cherry-pick: ci: static-checks: Don't hardcode default repo branch by @sprt in #403
• network: preseed default-gateway neighbor by @Redent0r in #407
• Cherry-pick upstream CI hardening commits and eliminate pull_request_target by @sprt in #411
• cherry-pick: ci: Run Zizmor on pushes to any branch by @sprt in #413
• runtime: clh: Use msft/v41.0.139 API YAML by @Redent0r in #414
• ci: security: Cherry-pick all Zizmor fixes from upstream by @sprt in #416
• webhook: enforce min memory limits and allow privileged containers by @Redent0r in #418
• cherry-pick: agent/rustjail: Fix double free in TTY handling by @sprt in #420
• agent: disable detect_initdata_device by @danmihai1 in #422
• version: Bump sirupsen/logrus by @Sumynwa in #426
• msft-main: runtime: upgrade to CH v51.1 by @Redent0r in #439

Full Changelog: 3.19.1.kata2...3.19.1.kata3