feat(sbom-tools): add CodeQL integration scripts (#325)

Usage (e.g. in mongosh):

```
npx mongodb-sbom-tools fetch-codeql-results \
  --sarif-dest=.sbom/codeql.sarif.json \
  --dependencies=.sbom/dependencies.json \
  --exclude-repos=mongodb-js/kerberos && \
npx mongodb-sbom-tools sarif-to-markdown \
  --sarif=.sbom/codeql.sarif.json \
  --md=.sbom/codeql.md
```

Author: addaleax

package-lock.json

@@ -74,6 +74,7 @@
     "webpack": "^5.82.0"
   },
   "dependencies": {
+    "@octokit/rest": "^20.1.1",
     "@pkgjs/nv": "^0.2.1",
     "commander": "^10.0.1",
     "error-stack-parser": "^2.1.4",

packages/sbom-tools/package.json

@@ -2,10 +2,14 @@ import { program } from 'commander';
 import { command as generate3rdPartyNotices } from './commands/generate-third-party-notices';
 import { command as generateVulnerabilityReport } from './commands/generate-vulnerability-report';
 import { command as scanNodeJs } from './commands/scan-node-js';
+import { command as fetchCodeQLResults } from './commands/fetch-codeql-results';
+import { command as sarifToMarkdown } from './commands/sarif-to-markdown';
 
 export function main(argv: string[]): void {
   program.addCommand(generateVulnerabilityReport);
   program.addCommand(generate3rdPartyNotices);
   program.addCommand(scanNodeJs);
+  program.addCommand(fetchCodeQLResults);
+  program.addCommand(sarifToMarkdown);
   program.parse(argv);
 }