Review Code Scanning Alerts

[RafaelGSS]

https://github.com/nodejs/node/security/code-scanning

[RafaelGSS]

We should ignore CodeQL on deps/

[richardlau]

We should probably exclude the same directories for CodeQL as we do for Coverity.

[RafaelGSS]

Rules

1. Unnecessary pins of packages maintained by Node.js. We trust packages that are maintained by the Node.js team.
2. For Dockerfile that pull images from the official well-known operating system distributions, we don't require having those versions pinned by hash -- It's better to get security fixes asap, as delaying it by waiting for an automated update.

Questions

Can we pin this? https://github.com/nodejs/node/security/code-scanning/774 @F3n67u (tagging you as you were the one who wrote that file)