Adapt to modified LGTM_ env variables behavior

[mbaluda]

• use LGTM_INDEX_FILETYPES: ".json:JSON" to include model.json and *.cds.json files in the DB
• replace third party action sergeysova/jq-action with a one-liner script
• renamed the Code Scanning configuration name so that alerts are recreated correctly
• update javascript.sarif.expected file

[jeongsoolee09]

@mbaluda Thanks! It looks good overall. Question: why are files in log-injection-with-service1-protocol-none and log-injection-with-service2-protocol-none renamed?

[mbaluda]

@jeongsoolee09 Code Scanning running an updated version of the query will not open a new alert if the location does not change, but instead it will reuse the old one. To see the correct result (only one source in service1) I had to rename the test. An alternative could be to delete and recreate the configuration...

[jeongsoolee09]

@mbaluda I see, could you rename it back to the old name (log-injection-service1-protocol-none, and log-injection-service2-protocol-none, respectively) to keep it consistent with the other tests?

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[jeongsoolee09]

Looks good, thank you! Sometime we'll have to migrate from using these undocumented environment variables. 🤔