Actions: report floating tags of immutable Actions in actions/unpinned-tag

[Darkslayer3324j]

Fixes #22414.

I found that actions/unpinned-tag exempted every Action on the
immutable-actions list from the unpinned-tag warning, whatever ref it used.
GitHub's immutability only covers complete release tags (vX.Y.Z) and commit
SHAs; floating tags such as v4, v4.1, main or latest are moved by the
maintainers and stay mutable. UnversionedImmutableAction does not catch these
either, because its isSemVer accepts bare majors like v4.

Change

• UseOfUnversionedImmutableAction.qll: I added isFullSemVer (complete
  X.Y.Z, optional v prefix, pre-release and build metadata) and had
  isSemVer reuse it, so the existing regex is not duplicated and
  UnversionedImmutableAction is unchanged.
• UnpinnedActionsTag.ql: the immutable-Action exemption now also requires
  isFullSemVer(version). Full commit SHAs and lockfile pins were already
  handled by the earlier conditions; trusted-owner exemptions are untouched.
• Change note (minorAnalysis).

As noted on the issue, actions and github are trusted by default, so the gap
only shows without extra config for octokit/request-action. It is also visible
for any immutable Action once its owner is distrusted with a !owner entry
(#22415), which is why I put the new cases in the CWE-829-untrusted-owner
test.

Tests

• I added CWE-829-untrusted-owner/.github/workflows/unpinned_immutable.yml
  with inline # $ Alert expectations: floating tags (v4, v4.1, main,
  latest, and octokit/request-action@v2, @v2.x) are reported; v4.2.2,
  4.2.2, v4.2.2-rc.1, octokit/request-action@v2.1.9 and a full SHA are
  not. I checked that without the query change all six alerts show up as
  Missing result: Alert; with it the test passes.
• CWE-829/UnpinnedActionsTag.expected gains 4 alerts, all the existing
  octokit/request-action@v2.x / @v2.x.x uses (regenerated with
  codeql test run --learn).
• I ran codeql test run over CWE-829, CWE-829-Lockfile and
  CWE-829-untrusted-owner: 10/10 pass, including UnversionedImmutableAction.
  codeql query format --check-only is clean on both changed QL files.

Assisted with Claude.