Report on dependencies only

[ipmb]

I don't have access to CodeQL yet, but am interested in generating reports just on dependency vulnerabilities. Would you consider a flag that allows this functionality?

[peter-murray]

That is a good idea and would not be particularly difficult to do.

I am working on some more changes in a TypeScript branch for this project to make it easier for others to collaborate on and will look to rolling this request into those changes.