Suppress CodeQL weak-crypto alert for RFC 6455 WebSocket handshake SHA-1

The WebSocket protocol (RFC 6455 §4.2.2) mandates SHA-1 for computing
the Sec-WebSocket-Accept header. This is not used for security purposes.
Added both @SuppressWarnings and lgtm suppression comments.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: c4e523e3-9d39-4598-90ec-54d959c44ce8

Author: edburns

java/sdk/src/test/java/com/github/copilot/FakeUpstreamServer.java

@@ -162,7 +162,10 @@ private void serveHttp(InputStream in, OutputStream out, String path, Map<String
 
     private void serveWebSocket(InputStream in, OutputStream out, Map<String, String> headers) throws Exception {
         String key = headers.get("sec-websocket-key");
-        MessageDigest sha1 = MessageDigest.getInstance("SHA-1");
+        // SHA-1 is mandated by the WebSocket protocol (RFC 6455 §4.2.2) for the
+        // Sec-WebSocket-Accept handshake hash. This is NOT used for security purposes.
+        @SuppressWarnings("codeql[java/weak-cryptographic-algorithm]")
+        MessageDigest sha1 = MessageDigest.getInstance("SHA-1"); // lgtm[java/weak-cryptographic-algorithm]
         byte[] digest = sha1.digest((key + WS_MAGIC).getBytes(StandardCharsets.US_ASCII));
         String accept = Base64.getEncoder().encodeToString(digest);
         String response = "HTTP/1.1 101 Switching Protocols\r\n" + "Upgrade: websocket\r\n" + "Connection: Upgrade\r\n"