chore: exclude cs/useless-upcast by id so WUApiLib COM-interop alerts clear

[laurentiu021]

Six CodeQL alerts reappeared after the Windows Update COM-lifetime work (#915): cs/useless-upcast on the WUApiLib dynamic casts in WindowsUpdateService, plus cs/nested-if-statements.

Root cause

The existing cs/useless-upcast exclude used a path: key inside query-filters — but path is not a valid key there (only id and tags are honoured), so the path-scoped exclude silently never matched and the alerts were never suppressed.

Fix (.github/codeql-config.yml, no release)

• Drop the dead path: key from the cs/useless-upcast exclude so it filters by id (matching the other working excludes). These casts ((bool)u.IsDownloaded, (string)u.Identity.UpdateID, …) are load-bearing conversions from late-bound COM dynamic to the concrete type — removing them would propagate dynamic and lose type safety. Zero legitimate hand-written hits exist.
• Add cs/nested-if-statements (pure readability suggestion; also fires on [GeneratedRegex] output under obj/).

chore: — config only, no code change, no release.