Make the qlpack compatible with MRVA

[aeisenberg]

Previously, there was an issue with the codeql submodule being nested
inside the parent qlpack. This change makes the workshop's qlpack a
sibling of the codeql workspace.

There are also some changes to the qlpack.yml itself. These are not
necessary, but make the qlpack.yml more canonical:

• Remove the version to prevent the pack from accidentally being
  published.
• Add a name with a scope to properly identify the package.
• Convert libraryPathDependencies to dependencies and use the
  library pack.

[pwntester]

Thanks a lot @aeisenberg!

Convert libraryPathDependencies to dependencies and use the library pack.

I tried that but it makes my neovim plugin to fail. The reason is that Im using codeql resolve library-path --search-path=../codeql --query xxxx.ql and when using dependencies it fails with ERROR: Referenced pack 'codeql/java-all' not found. Im reading https://codeql.github.com/docs/codeql-cli/about-ql-packs/ but Im not sure about the differences between the two. In addition, I think it would be great to update that doc to include your other suggestions (version is optional and name should be scoped)

[pwntester]

Scratch that, it seems I have to pass --additional-packs instead of --search-path as per https://github.com/github/vscode-codeql/blob/b53657344c320831a2f3389b99fc1bbdfef3f571/extensions/ql-vscode/src/cli.ts#L517

[pwntester]

LSP server is not correctly picking the qlpacks now though. I can see from the help doc that codeql execute language-server does not take additional-packs arg because its provided by the LSP client There are no --additional-packs or --library-path options, as the corresponding values are provided online by the IDE extension through the language server protocol.. Do you know if LSP client needs any special config?

[pwntester]

Got it working after running codeql pack install. Using this approach I dont seem to need the codeql submodule anymore, is that correct?

[aeisenberg]

That is correct. It is no longer needed.

We're aware that the docs for packaging are not up to date. It's just not something that we've had the resources to look into yet.