Improve logging around authorization headers

src/codeql.ts

@@ -514,14 +514,13 @@ async function downloadCodeQL(
   // from the same GitHub instance the Action is running on.
   // This avoids leaking Enterprise tokens to dotcom.
   // We also don't want to send an authorization header if there's already a token provided in the URL.
-  if (
-    codeqlURL.startsWith(`${apiDetails.url}/`) &&
-    !searchParams.has("token")
-  ) {
-    logger.debug("Downloading CodeQL bundle with token.");
+  if (searchParams.has("token")) {
+    logger.debug("CodeQL tools URL contains an authorization token.");
+  } else if (codeqlURL.startsWith(`${apiDetails.url}/`)) {
+    logger.debug("Providing an authorization token to download CodeQL tools.");
     headers.authorization = `token ${apiDetails.auth}`;
   } else {
-    logger.debug("Downloading CodeQL bundle without token.");
+    logger.debug("Downloading CodeQL tools without an authorization token.");
   }
   logger.info(
     `Downloading CodeQL tools from ${codeqlURL}. This may take a while.`