Filter vulnerabilities by path

[factoidforrest]

Use the output of the first party callsite analysis for this.

Make sure that first party analysis is scoped to the manifest path that the vulnerability was discovered in, so that we dont over-match from different manifests in the same repo.

For example:

/package.json -> axios@1
/some/other/package/package.json -> axios@2

axios@1 contains a vulnerability.

/src/index.js has an import of axios, and should be flagged as being vulnerable (since /package.json contains the vulnerable version).

/some/other/package/src/index.js also contains an import of axios, but this should not be marked as vulnerable since the version of axios used is axios@2

Tasks:

• Easiest path is building a UI to hold ignore rules
• Harder path is putting a .lunatraceignore file into repos