Add explanation for CodeQL suppressions. (#2263)

Author: brianrob

src/TraceEvent/Symbols/NativeSymbolModule.cs

@@ -664,11 +664,11 @@ private void TryInitializeCppChecksum(IDiaSourceFile sourceFile)
                 // 3 checksum generated with the SHA256 hashing algorithm.
                 if (sourceFile.checksumType == 1)
                 {
-                    _hashAlgorithm = System.Security.Cryptography.MD5.Create(); // lgtm [cs/weak-crypto]
+                    _hashAlgorithm = System.Security.Cryptography.MD5.Create(); // lgtm [cs/weak-crypto] The PDB specifies the checksum algorithm.  This is not controlled by TraceEvent.
                 }
                 else if (sourceFile.checksumType == 2)
                 {
-                    _hashAlgorithm = System.Security.Cryptography.SHA1.Create(); // lgtm [cs/weak-crypto]
+                    _hashAlgorithm = System.Security.Cryptography.SHA1.Create(); // lgtm [cs/weak-crypto] The PDB specifies the checksum algorithm.  This is not controlled by TraceEvent.
                 }
                 else if (sourceFile.checksumType == 3)
                 {
@@ -725,11 +725,11 @@ private void TryInitializeManagedChecksum(NativeSymbolModule module)
 
                     if (srcFormat.Header.algorithmId == guidMD5)
                     {
-                        _hashAlgorithm = System.Security.Cryptography.MD5.Create(); // lgtm [cs/weak-crypto]
+                        _hashAlgorithm = System.Security.Cryptography.MD5.Create(); // lgtm [cs/weak-crypto] The checksum algorithm is specified by the injected source.  This is not controlled by TraceEvent.
                     }
                     else if (srcFormat.Header.algorithmId == guidSHA1)
                     {
-                        _hashAlgorithm = System.Security.Cryptography.SHA1.Create(); // lgtm [cs/weak-crypto]
+                        _hashAlgorithm = System.Security.Cryptography.SHA1.Create(); // lgtm [cs/weak-crypto] The checksum algorithm is specified by the injected source.  This is not controlled by TraceEvent.
                     }
                     else if (srcFormat.Header.algorithmId == guidSHA256)
                     {

src/TraceEvent/Symbols/PortableSymbolModule.cs

@@ -119,7 +119,7 @@ internal PortablePdbSourceFile(DocumentHandle documentHandle, PortableSymbolModu
                 Guid hashAlgorithmGuid = metaData.GetGuid(sourceFileDocument.HashAlgorithm);
                 if (hashAlgorithmGuid == HashAlgorithmSha1)
                 {
-                    _hashAlgorithm = System.Security.Cryptography.SHA1.Create(); // lgtm [cs/weak-crypto]
+                    _hashAlgorithm = System.Security.Cryptography.SHA1.Create(); // lgtm [cs/weak-crypto] The PDB specifies the checksum algorithm.  This is not controlled by TraceEvent.
                 }
                 else if (hashAlgorithmGuid == HashAlgorithmSha256)
                 {

src/TraceEvent/TraceEventSession.cs

@@ -3053,7 +3053,7 @@ public static Guid GetEventSourceGuidFromName(string name)
             }
 
             // Compute the Sha1 hash
-            var sha1 = System.Security.Cryptography.SHA1.Create(); // lgtm [cs/weak-crypto]
+            var sha1 = System.Security.Cryptography.SHA1.Create(); // lgtm [cs/weak-crypto] The EventSource name to GUID protocol requires a SHA1 hash.
             byte[] hash = sha1.ComputeHash(bytes);
 
             // Create a GUID out of the first 16 bytes of the hash (SHA-1 create a 20 byte hash)

src/TraceParserGen/Program.cs

@@ -636,7 +636,7 @@ private static Guid GenerateGuidFromName(string name)
         }
 
         // Compute the Sha1 hash
-        var sha1 = System.Security.Cryptography.SHA1.Create(); // lgtm [cs/weak-crypto]
+        var sha1 = System.Security.Cryptography.SHA1.Create(); // lgtm [cs/weak-crypto] The EventSource name to GUID protocol requires a SHA1 hash.
         byte[] hash = sha1.ComputeHash(bytes);
 
         // Create a GUID out of the first 16 bytes of the hash (SHA-1 create a 20 byte hash)