[ci] fix false positive CVE scan from node

[asraa]

Signed-off-by: Asra Ali asraa@google.com

Commit Message: Fixes a false positive caught by the CVE scanner from a Node issue
Additional Description:
Risk Level: Low
Testing:
Docs Changes:
Release Notes:
Platform Specific Features:
[Optional Runtime guard:]
[Optional Fixes #Issue]
[Optional Deprecated:]
[Optional API Considerations:]

See https://dev.azure.com/cncf/envoy/_build/results?buildId=83597&view=logs&j=12f1170f-54f2-53f3-20dd-22fc7dff55f9&t=9c939e41-62c2-5605-5e05-fc3554afc9f5&l=164

  CVE ID: CVE-2021-22918
  CVSS v3 score: 5.3
  Severity: MEDIUM
  Published date: 2021-07-12
  Last modified date: 2021-07-20
  Dependencies: com_github_nodejs_http_parser
  Description: Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-
  bounds read when uv__idna_toascii() is used to convert strings to
  ASCII. The pointer p is read and increased without checking whether it
  is beyond pe, with the latter holding a pointer to the end of the
  buffer. This can lead to information disclosures or crashes. This
  function can be triggered via uv_getaddrinfo().
  Affected CPEs:
  - cpe:2.3:a:nodejs:node.js:*

  CVE ID: CVE-2021-22921
  CVSS v3 score: 7.8
  Severity: HIGH
  Published date: 2021-07-12
  Last modified date: 2021-07-15
  Dependencies: com_github_nodejs_http_parser
  Description: Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local
  privilege escalation attacks under certain conditions on Windows
  platforms. More specifically, improper configuration of permissions in
  the installation directory allows an attacker to perform two different
  escalation attacks: PATH and DLL hijacking.