CodeQL issues for vendored JS

CodeQL complains of issues with vendored code that is bundled into `coldfront.js` that is part of the Bootstrap sanitizer. We could turn this scanner off or figure out a way to minimize the bundle to exclude the scripts that trigger the errors.

