Does not override GIT_SSH_COMMAND when not needed.

This file was useful to verify the zip bomb protections worked properly against a real "zip bomb", but is not required to verify out mitigations works in our tests.

Including a real zip bomb lead to confusion and reports of anti-virus causing issues for users.

Remove `bomb.zip` test file to stop anti-virus noise

Fixes #299

remove repo-specific codeql action, in favor of centralized job

The function already returns early if the specified 'netrc' configuration points to a non existing file, but currently returns an error if the OS reports ENOTDIR:

This will happen if the $HOME directory of the specified user points to a file instead a directory - something eg. 'void linux' does for user 'nobody':

```
$ grep nobody /etc/passwd
nobody:x:99:99:Unprivileged User:/dev/null:/bin/false
```

go-getter then attempts to open `/dev/null/.netrc` which fails with ENOTDIR - something that should just be threated the same way as a non existing file (in this case)

…3-04-21

SEC-090: Automated trusted workflow pinning (2023-04-21)

…3-09-11

SEC-090: Automated trusted workflow pinning (2023-09-11)

…3-09-18

SEC-090: Automated trusted workflow pinning (2023-09-18)

The reason for setupGitEnv is to add a `-i keyfile` argument to
GIT_SSH_COMMAND. If there is no keyfile, we do not need to modify the
environment at all.

don't change GIT_SSH_COMMAND when there is no sshKeyFile

Make addAuthFromNetrc ignore ENOTDIR errors

Prevent Git Config Alteration on Git Update