Software Development Static Analysis Pitfalls: Why Your CodeQL Query Might Be Lying to You (And How to Fix It)