Allow notes for allowlist items

[villesau]

Usually it is good to let other devs to know why something has been ignored. That's why being able to leave notes next to the ignore is important. It might be that the vulnerability does not affect the repo, or then there is no fix available, or it might be something else.

For the reference, this is how better-npm-audit does it: https://github.com/jeemok/better-npm-audit#using-nsprc-file-to-manage-exceptions

[quinnturner]

Thanks for the feedback! I see no reason why we can't support a similar nsprc file format (at least, within the already existing allowlist array).

"allowlist": [
  "GHSA-42xw-2xvc-qx8m",
  "GHSA-rp65-9cf3-cjxr": {
    "active": true,
    "notes": "Ignored since we don't use xxx method",
    "expiry": 1615462134681
  }
]

Until that's implemented, we do support comments within the JSON. If you're going to use comments, I recommend using the file extension .jsonc for compatibility with IDEs.

[villesau]

Thanks for the hint! Indeed a comment is a good workaround for this for the time being.