Add threat-models as a property to config file and inputs

There's a lot of changes here, but it's pretty formulaic. It follows the
approach used by the `queries` input and config property.
`threat-models` can appear as an input or in the config file. If it
appears in the input, then we need to either merge it with the
threat-models in the config (if prefixed with `+`) or overwrite it.

There's no danger if someone uses `threat-models` with an older CLI
since the CLI can handle configs with extra properties.

lib/codeql.js

@@ -743,6 +743,23 @@ async function generateCodeScanningConfig(codeql, config, features, logger) {
             augmentedConfig.packs["javascript"].push(packString);
         }
     }
+    // Inject the threat-models from the input
+    if (config.augmentationProperties.threatModelsInput) {
+        if (config.augmentationProperties.threatModelsInputCombines) {
+            // threat-models input combines with threat-models from the config file
+            // (if any were defined).
+            augmentedConfig["threat-models"] = (augmentedConfig["threat-models"] || []).concat(config.augmentationProperties.threatModelsInput);
+        }
+        else {
+            // threat-models input overrides threat-models from the config file
+            augmentedConfig["threat-models"] =
+                config.augmentationProperties.threatModelsInput;
+        }
+    }
+    if (Array.isArray(augmentedConfig["threat-models"]) &&
+        !augmentedConfig["threat-models"].length) {
+        delete augmentedConfig["threat-models"];
+    }
     logger.info(`Writing augmented user configuration file to ${codeScanningConfigFile}`);
     logger.startGroup("Augmented user configuration file contents");
     logger.info(yaml.dump(augmentedConfig));