DCJ-667: Use better-npm-audit for CI instead of plain npm-audit

[rushtong]

Addresses

https://broadworkbench.atlassian.net/browse/DCJ-667

Summary

This PR does two things:

1. Replace usages of npm audit with better-npm-audit audit -p
2. Adds an exclusion for the path-to-regexp finding

The path-to-regexp finding will be handled with https://broadworkbench.atlassian.net/browse/DCJ-294. In the meantime, this finding should not prevent other work from proceeding. This PR allows for that to happen and also provides a better way of managing potential exclusions in the future.

---

Have you read Terra's Contributing Guide lately? If not, do that first.

• Label PR with a Jira ticket number and include a link to the ticket
• Label PR with a security risk modifier [no, low, medium, high]
• PR describes scope of changes
• Get a minimum of one thumbs worth of review, preferably two if enough team members are available
• Get PO sign-off for all non-trivial UI or workflow changes
• Verify all tests go green
• Test this change deployed correctly and works on dev environment after deployment

[fboulnois]

See below:

[fboulnois]

Although I can see the advantages of this package, I have a few concerns:

• It is itself an npm dependency that depends on a number of packages that may have vulnerabilities
• According to the Readme , they are looking for collaborators, which suggests that it may not be well maintained (although I do see a recently published version)
• npm seems to change the audit command behavior between major versions, which also requires major changes to this package

Instead could we:

1. not depend on npm audit in Pull Requests?
2. run npm audit in a non-blocking way?
3. run npm audit on a schedule?

[rushtong]

This PR is no longer necessary. #2673 updated the underlying problem behind this effort.