Deploy query releases to GitHub Pages and enforce UTF-8 reports

[martinsohn]

Summary

• Write test-report.md explicitly as UTF-8 to handle non-ASCII query content consistently.
• Upload the generated Queries.json as a GitHub Pages artifact.
• Deploy the artifact after the test and release jobs succeed.
• Restrict release publishing to the upstream SpecterOps/BloodHoundQueryLibrary repository.
• Grant each job only the permissions required for releases and Pages deployment.

Motivation

queries.specterops.io loads the catalog from:

https://specterops.github.io/BloodHoundQueryLibrary/Queries.json

The release workflow generated an up-to-date Queries.json for GitHub releases, but did not update the Pages copy. This caused queries.specterops.io to use an older query catalog.

Explicit UTF-8 output also prevents test-report generation from depending on the runner's default encoding.

Expected behavior

After a successful push to main:

1. Query validation completes.
2. Queries.json and Queries.zip are generated for the draft release.
3. The same Queries.json is uploaded and deployed to GitHub Pages.
4. queries.specterops.io receives the current catalog from its existing source URL.

Release and deployment jobs are skipped in forks. No query definitions or platform behavior are changed.

Testing

• git diff --check passes.
• Query syntax validation will run on this PR.
• The production Pages deployment can be verified after merge by comparing the number of objects in the published Queries.json with the YAML files under queries/.

Deployment note

GitHub Pages is configured to use GitHub Actions as its publishing source.