CodeQL: exclude libtest demos and src/proxy from scanning

libtest/ holds demo callback samples that aren't part of libhttrack, and
src/proxy/ is ProxyTrack, a separate legacy binary with no auth surface whose
recv/cache-parse code trips the taint queries by design. Together they account
for ~26 alerts that are false-positive or by-design. Exclude both so the
dashboard tracks the engine, where the queries earn their keep.

Genuine bugs found in that code are fixed on their own, independent of scanning.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Xavier Roche <roche@httrack.com>

.github/workflows/codeql.yml

@@ -46,6 +46,12 @@ jobs:
           # fopen's umask-controlled 0666 is intended for mirror/cache/log
           # output; the one credential file (cookies.txt) is kept 0600 on Unix.
           config: |
+            paths-ignore:
+              # Demo callback samples, not part of libhttrack.
+              - libtest
+              # ProxyTrack: a separate legacy binary with no auth surface; its
+              # recv/cache-parse code trips taint queries by design.
+              - src/proxy
             query-filters:
               - exclude:
                   id: cpp/world-writable-file-creation