This is a good question, and answered because of the origin of the GPL. The GPL intentionally distinguishes between the SOFTWARE used to create the work (e.g. Visual Studio, GCC, or - in this case - GarageBand) and the DATA fed into that software (source code, or - in this case - note data and samples). Otherwise it would be not allowed to compile open source software with a commercial compiler.
By "the software", the typical definition would be "all that is part of the stock package of GarageBand, and all SOFTWARE plugins you downloaded for it". It is none of your concern if such plugins are actually generating the music using samples or algorithmically (most BTW work algorithmically), as long as from the user's perspective they appear as a software package and not as a data download.
That line can be blurry in some cases of course, e.g. when using a synthesizer application using wavetable synthesis. My personal opinion here is that anything you bought or downloaded that was clearly labeled software, can be treated as such regarding the GPL no matter how it internally works - and that means it won't be part of the "source". If it was clearly labeled as data (e.g. samples from a samples collection website), it is part of the "source" and thus has to have "GPL friendly" license terms.
A nice point on that "blurry line" is VOCALOID. The various voice CDs for it are marketed as different software packages (and the voices in it cannot be exchanged; there are no separately obtainable voice packs, neither by the vendor nor by users on the internet) - but in fact, you can easily use the voice data of one of the CDs with the software on another, and then have both voices integrated. As long as you own only one of these CDs, from your point of view it clearly is software and not data, and thus the output can be used in GPL compatible works (as long as you also provide the VOCALOID input file with the syllables and notes). Once you have more than one, it becomes apparent that it is one software with different data packages, and THEN the data may or may not have to be part of the source. Personally, I'd even then argue that the data is NOT part of the source, as VOCALOID is still marketed as a software and not as a data package. But opinions differ on this point.
As this is a point in a legal grey zone, we can - even IF a court rules the voice data has to be part of the source - claim good faith and get away with it (after deleting the offending song). But then, why would this ever end up in court anyway, as there are many buts regarding who can sue at all (as only those whose rights are violated can sue).
Other Xonotic contributors? Unlikely.
Other DarkPlaces contributors? No way, as the general opinion among most DP users and contributors is that you even can combine the GPL DP engine with non-free data.
Id Software (Bethesda)? Possibly. But as it already is unclear whether the the GPL from the engine does or does not "extend" to the data, we would really be the last ones getting sued over this. Way easier targets would be Tremulous, Warsow, and lots of other games doing the same.
Copyright holder of the software: they authorized you to distribute the song, and your source files are all your own copyright. As long as you don't distribute THEIR work, they can't do anything about it. Only way for them to sue, would be a court ruling forcing us (and you) to release the source data INCLUDING that software, and THEN the copyright holder of the software can sue.
So, to conclude: if it's labeled as software/plugin/whatever, it's not part of the source and thus can be under any license, even commercial, as it won't become part of your work. If it's labeled as data/samples/whatever, it is part of the source and then must be GPL compatible, as they do become part of your work.
