codeql workflow: Switch from pip to apt

codeql workflow: Switch from pip to apt

On some runs:

Run pip install --break-system-packages -r requirements.txt
....
no such option: --break-system-packages
Error: Process completed with exit code 2.

On other runs it refuses to install and asks for that option
as it refuses to override system packages.

Also require ubuntu-latest only, as MacOS is not supported at all
by libfuse.