Update CodeQL bundle to 20210517 / 2.5.5

Add warnings about CLI hack to codeql.ts

These warnings refer to a hack that was added to the CLI in
https://github.com/github/semmle-code/pull/39335

They can be removed again once the CLI has a more principled way for
the CLI to recognize that it's being invoked by the runner/action.

Add a tasks.json

Change include path for lines of code counting

Previously, we were always using `**` in the include path. the
effect of this was to always count lines in the entire
repository unless explicitly added to the paths-ignore. This
was incorrect behaviour. Now we only using `**` if the include
path is otherwise empty.

Use the prefix id for keying into metrics rules

Fixes a bug where we were looking for incorrect keys for metrics rules.
Previously, we were using full language names in the keys. Now, we use
the short language names in the metric ids. This is done through a
simplification of the code.

Also, this change does two smaller things:

1. Prints out the baseline count to the logs
2. Adds the `assertNever` function to ensure we never miss a case in
   a switch statement. This function is borrowed from vscode-codeql.

Update loc count library

This is just a helpful way to ensure you can run `tsc --watch` from
inside vscode.

This version will count lines of code in each file serially. It still
runs all file system operations asynchronously. The only difference now
is that it will only count one file at a time. It is slower, but it
is able to count large repositories without running out of memory.

Output environment file for Windows

Fix security vulnerabilities

Fix information about `npm ci`

Co-authored-by: Robert <robertbrignull@github.com>

Make matrix run all cases of the python-deps tests

Ran `npm audit fix`.

Even though this fixes a "high" severity vulnerability, all affected
packages are dev packages only.

Update contributing guide

This adds a section on checking in compiled artifacts.

Add category input

Fix lines of code mapping

We were inadvertently using codeql language ids instead of the action's
language ids. There is now a 3-way mapping between the ids used by
the lines counter library, the action, and codeql.