Add actions.lock extraction

Teach the JavaScript extractor to classify .lock files as YAML while limiting default autobuild extraction to explicitly included paths. Expose Actions lockfiles through the ActionsLock QL class and cover extraction with QL and database-creation integration tests.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4994bb27-c5ca-47e9-b082-cfc1ca244e86