feat(build): add vulnerability codeql scanning

[nitrocode]

what

• add vulnerability codeql scanning
• fix zipslip

why

• Reduce number of vulnerabilities introduced by code changes

references

• Starts Resolve CodeQL issues #2884
• More info https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning-with-codeql
• Full list of advisories generated https://github.com/runatlantis/atlantis/security/code-scanning?query=pr%3A2879+tool%3ACodeQL+is%3Aopen

[krrrr38]

LGTM

BTW/FYI we cannot see this url. https://github.com/runatlantis/atlantis/security/code-scanning?query=pr%3A2879+tool%3ACodeQL+is%3Aopen

[jamengual]

as long as this work based on the files included on PRs and not the whole project then it LGTM.

[jamengual]

LGTM

BTW/FYI we cannot see this url. https://github.com/runatlantis/atlantis/security/code-scanning?query=pr%3A2879+tool%3ACodeQL+is%3Aopen

I can see it, maybe this need to be setup as repo level.

[nitrocode]

BTW/FYI we cannot see this url. https://github.com/runatlantis/atlantis/security/code-scanning?query=pr%3A2879+tool%3ACodeQL+is%3Aopen

@krrrr38 Perhaps only maintainers can see this? I created this ticket for now and i expand on it if you'd like to work on it #2884.

@jamengual since we have the associated ticket. We can dismiss the current issues as non-issues (even tho they are real issues) and associate the ticket in the message. Then we can merge this with passing pr checks so future prs that are contributed will pass or fail depending on the contributed code.