Remove obsolete Java/Python local-source suites superseded by threat-models: local

[Copilot]

CodeQL's built-in threat-models: local setting, applied to the default (non-local) queries, now provides the coverage these community-pack -local suites were built for. Both suites were also independently non-functional.

Removed suites

• java/src/suites/java-local.qls: referenced an undeclared codeql/java-queries dependency (unresolvable); all 12 listed upstream query IDs were deleted in CodeQL 2.17.4 anyway; its one GHSL query reference (java/xxe-local) never matched the query's actual @id (githubsecuritylab/xxe-local).
• python/src/suites/python-local.qls: always resolved to zero queries due to a YAML bug:

# tags contain: -local  parses as the literal string "-local", not a list
# exclusion of the "local" tag — this filter never matched anything.
- include:
    tags contain: -local

Config

• configs/synthetics.yml: dropped the two -local suite entries. threat-models: local stays, since it's the mechanism now providing equivalent coverage on the default (non-suffixed) queries.

Versioning

• Bumped java/src/qlpack.yml and python/src/qlpack.yml (0.7.5 → 0.8.0), since a named, externally-referenceable suite is being removed from each pack.

Out of scope

The individual *Local.ql queries and LocalSources.qll/XMLLocalLib.qll libraries are untouched. They already run via the default java.qls/python.qls suites regardless of the removed suites, and GHSL's local-source libraries cover some file-read sources (e.g. pickle, pandas, yaml) beyond upstream's "file" threat model, so removing them isn't a pure no-op. Left as a separate follow-up if desired.

• Fixes End of life the local packs with new configurable threat-models setting in CodeQL #69

[felickz]

@copilot these CIs are failing - https://github.com/GitHubSecurityLab/CodeQL-Community-Packs/actions/runs/31428133394/job/95480891186?pr=218
https://github.com/GitHubSecurityLab/CodeQL-Community-Packs/actions/runs/31428133394/job/95480891169?pr=218

Is there an outage or is this something we impacted in this change?

[Copilot]

@copilot these CIs are failing - https://github.com/GitHubSecurityLab/CodeQL-Community-Packs/actions/runs/31428133394/job/95480891186?pr=218
https://github.com/GitHubSecurityLab/CodeQL-Community-Pack...

Upstream, not something this PR's diff caused. Both jobs fail in the Install Packs step before any of our changed files are even read:

A fatal error occurred: Could not get manifest for codeql/python-all@7.2.3 ...
(eventual cause: UnrecognizedPropertyException "Unrecognized field \"digest\" ...")

(same signature for codeql/java-all@9.2.3 in the java job)

Those two versions were just published under CLI 2.26.3's new upload format, manifests are tagged com.github.codeql.cli.version: 2.26.3. The 2.26.3 changelog (2026-08-12) explains why: "Fixed the pack upload format to comply with the OCI-image-manifest specification, by ensuring that all required fields are present/valid, and that no extraneous/non-compliant fields are included." Our pinned CLI here is still 2.26.2, whose older manifest parser rejects the new, now-compliant format. Our qlpack.yml/lock files still pin python-all@7.2.2/java-all@9.2.2, but pack install has to enumerate available versions to resolve dependencies, and it dies on the newest one before it ever reaches the locked version.

Not a broader outage: cpp/csharp/go/javascript/ruby compile-and-test all passed in this same run, only python/java hit the newly-republished packs.

This will keep failing on any python/java PR until the CLI pin here moves to 2.26.3+. #220 already looks like it's prepping the update-codeql-version workflow for that bump, so that's the real fix path, out of scope for this PR.