Change from `metric` to `rule`

The SARIF that we are interpreting has moved away from using `metric`
to the more general term, `rule`. We need to adapt our baseline lines of
code counting to use `rule` as well.

Update CodeQL bundle to 20210503 / 2.5.4

update bundle to 20210430

Restrict Actions token permissions in CodeQL workflow.

…d for runs that are not from pull requests.

Avoid analyzing excluded language files for line counting

This change passes in a list of file types to the line counting
analysis. These are the languages for the databases being analyzed.
Line count analysis is restricted to these files.

This version adds a larger list of auto-excluded binary files.
And allows for the passing of a list of file types to restrict
analysis to.

Add baseline metrics for lines of code

This commit uses a third party library to estimate the lines of code in
a database that is to be analyzed by codeql.

The estimate uses the same includes and excludes globs for determining
which files should be counted.

The lines of code count is returned by language and injected into the
SARIF as `baseline` property in the `${language}/summary/lines-of-code`
metric.

…ri-6.0.2

Bump ssri from 6.0.1 to 6.0.2 in /runner

Bumps [ssri](https://github.com/npm/ssri) from 6.0.1 to 6.0.2.
- [Release notes](https://github.com/npm/ssri/releases)
- [Changelog](https://github.com/npm/ssri/blob/v6.0.2/CHANGELOG.md)
- [Commits](https://github.com/npm/ssri/compare/v6.0.1...v6.0.2)

Signed-off-by: dependabot[bot] <support@github.com>

Add the github-linguist package

Introduce our own toolcache implementation for use by the runnner

This commit only adds a single package and all of its transitive
dependencies. The github-linguist package will be used for counting
lines of code as a baseline for databases we are analyzing.

update bundle to 20210421 (CLI 2.5.2)

Ignore non-string values in populateRunAutomationDetails

Add automationdetails id to runs