python-setup: Don't allow Poetry to make venv in project

[RasmusWL]

As highlighted in the code comments, Projects that specify in-project = true in their poetry.toml would get the venv created inside the repo directory, which would cause CodeQL to consider it as user-written code. We don't want this to happen.

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Confirm the readme has been updated if necessary.
• Confirm the changelog has been updated if necessary.

I have not updated changelog or readme since I thought this was a small enough change, but let me know if you think that woudl be needed.

[angelapwen]

I don't think we need to update the README for this change 😄

As for the CHANGELOG — do we expect the change to affect many users? If the venv was previously considered user-written code, and now isn't, it shouldn't affect any user's results (unless the venv itself had alerts), right?

[RasmusWL]

As for the CHANGELOG — do we expect the change to affect many users?

Many? that's not my expectation, but it's a gut feeling and not based on hard data.

If the venv was previously considered user-written code, and now isn't, it shouldn't affect any user's results (unless the venv itself had alerts), right?

spot on. I think there's a fair chance there would have been spurious alerts found within the in-project venv though.

Altogether, I have time defending not making adding anything to the changelog, so let me just do that 👍

[angelapwen]

Thanks for updating!

[angelapwen]

Suggested change

	- Python automatic dependency installation will no longer consider dependecy code installed in venv as user-written, for projects using Poetry that specify `virtualenvs.in-project = true` in their `poetry.toml`. [#1419](https://github.com/github/codeql-action/pull/1419).
	- Python automatic dependency installation will no longer consider dependency code installed in `venv` as user-written, for projects using Poetry that specify `virtualenvs.in-project = true` in their `poetry.toml`. [#1419](https://github.com/github/codeql-action/pull/1419).

Quick typo suggestion