Always test against both the default and latest CodeQL bundle.
This improves test coverage shortly after a CodeQL bundle release, where the latest bundle
may not yet be built into the Actions VM image as the default bundle.
It also saves a manual step during bundle release testing,
since we no longer need to temporarily change the PR checks to `tools: latest`.
There is some redundancy when the latest bundle is the same as the default bundle on the VM image,
but this can be considered a test for the `tools: latest` configuration.
