feat: 利用Github Action进行代码安全扫描，并生成报告

[nap0o]

NodeWarden 是对安全性要求很高的项目.

PR功能介绍

用github action在每次push时自动扫描代码安全漏洞，生成报告并推送到孤儿分支security-audit 上

代码安全检测项

• 用Gitleaks检测检查代码中的敏感信息
• 用CodeQL静态代码安全分析
• 用Trivy检测Dockerfile容器配置安全,没有Dockerfile则跳过
• 用Snyk检查依赖包漏洞

从snyk获取秘钥，在项目settings -> Actions secrets and variables
-> action -> 配置 SECURITY_SNYK_TOKEN 秘钥

大佬代码写的很好，只有几个warning

ps：我也在折腾一个2FA的项目: 2FAuth Worker ，向大佬学习。

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.