Produce separate SARIF file for quality-queries alerts

[mbg]

Follows on from #2917.

This PR modifies the action to produce separate SARIF files for code quality queries (as specified as arguments to the quality-queries input) and uploads them to the code quality API. The approach here is that:

• We make an additional call to database interpret-results for queries that were specified as arguments to the quality-queries input (if any). This results in SARIF files for those queries.
• We then upload them to the CQ API endpoint.

Notes

• The changes aim to be as backwards-compatible as possible. That includes:
  • We don't (yet) modify the existing SARIF files that are uploaded to the code scanning API to exclude results for quality-queries alerts.
  • SARIF files are output to the same place as before (e.g. as opposed to having separate subdirectories for security and quality SARIFs)

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Confirm the readme has been updated if necessary.
• Confirm the changelog has been updated if necessary.