Introduce a feature-flag to enable/disable lua-based tracing.

[criemen]

This allows us to gradually roll out (or even roll back)
Lua-based tracing in case problems occur.

This should not be merged before we are sure that 2.9.2 is the right CLI version to target, but otherwise this PR can be reviewed already.

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Confirm the readme has been updated if necessary.
• Confirm the changelog has been updated if necessary.

[henrymercer]

Generally looks good. I think we should add some tests that the appropriate arguments get passed / not passed when we expect. There are some examples of that for ML-powered queries in config-utils.test.ts.

[henrymercer]

Looks good to me. Before we merge, we should check that (a) 2.9.2 is the right CLI version as you mention in the PR description, and (b) that each of the CodeQL bundles containing CLI v2.9.2 have completely rolled out, in order to avoid alert churn from customers using different bundles in their Code Scanning runs. Alternatively we could merge with just (a) and make sure the feature flag is disabled until (b) holds.

[criemen]

Regarding b):
I believe action rolls out new images per repository, so unless they roll back an image mid-rollout, a customer should not see their codeql version jumping back and forth. Even then, this'll likely get you wobbles in alerts due to new/changed queries.
Also, in theory, enabling/disabling the Lua tracer does not change the generated database or the alerts that are being found (but, well, there might be bugs).
Thus, waiting with enabling the feature flag until 2.9.2 is fully rolled out is reasonable, with the exception of testing/internal repositories.
Testing with these internal repositories is the reason I'd like to get this merged as soon as we've settled a).

[henrymercer]

I believe action rolls out new images per repository, so unless they roll back an image mid-rollout, a customer should not see their codeql version jumping back and forth.

If that's the case, that would simplify dealing with these types of PRs. Do you have a source for this you could internally link me to?

[criemen]

Rebased on top of main to address a conflict.
I'd like to merge this now, as 2.9.2 is indeed the right release. Rolling the feature flag out will have to wait once the new CLI is in the toolcache, though.