Pin the CodeQL action to its v4.38.2 release

The init and analyze steps were pinned to 7999b86c, a commit no release tag
points at, with a "# v4" comment that names another commit (zizmor
ref-version-mismatch, two code-scanning alerts). Both steps now use
2892aa5e, the commit of v4.38.2, with that exact version as the comment.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Withhold secret-looking variables from the processes the runner starts

EnvironmentBlock replaced every non-ASCII character of an inherited name
with '?' before asking whether to withhold it, so --pass-env=MY_?_TOKEN
kept an unrelated MY_é_TOKEN. Names are now converted with Narrow, as
everything else the runner compares.

A block whose variables were all withheld, with no additions, ended in one
terminator; CreateProcessW needs two for an empty block.

The amalgamated sources are regenerated for the runner changes.

Workers and the other processes the runner starts copied its whole
environment, tokens and passwords included. ChildProcess::Start now
leaves out every variable whose name contains, in any case, TOKEN,
SECRET, PASSWORD, PASSWD, CREDENTIAL, API_KEY, APIKEY, PRIVATE_KEY or
ACCESS_KEY (IsSecretVariable), unless ChildOptions::keptEnvironment
names it; names compare without case on Windows.

--pass-env=NAME, repeatable, and "pass-env" in catch3.json keep a
variable for the tests. The runner itself still starts with the whole
environment, so code that runs before the first worker sees it;
docs/progmasoft-runner.md says so.

A runner test starts the shell's environment listing with a secret and
a plain variable set, sees only the plain one, and sees the secret once
it is kept.

Move the tools from Python to C++17 and Bazel

Release Catch3 0.3.0.2

Carry mocks in the amalgamated files