This PR skips validating SARIF files produced by CodeQL, unless we are running in a testing environment. This improves end-to-end performance.

We also only read the SARIF file once in the common case that only one file is being uploaded. Previously we read it twice. This should also speed things up, particularly for large SARIF files.

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Confirm the readme has been updated if necessary.
• Confirm the changelog has been updated if necessary.