fix(security): include targeted node_modules files in TypeScript semantic scans

[alxxjohn]

Motivation

• A previous change made the TypeScript semantic analyzer skip any source file whose resolved path contains node_modules, which caused fail-level security rules (e.g. security.typescript.insecure-tls) to be silently omitted when the semantic runtime is available.
• The change restores semantic coverage for files that are inside the configured target (including node_modules under that target) to avoid a scanner false negative that the file-walking fallback would otherwise have caught.

Description

• Removed the special-case node_modules exclusion from the semantic analyzability predicate by updating isAnalyzableSourceFile in internal/codeguard/checks/support/typescript_semantic_runner_core.js so files are accepted if they are non-declaration script files with a recognized extension and are isWithinTarget.
• Deleted the now-unused isNodeModulesPath helper function from internal/codeguard/checks/support/typescript_semantic_runner_core.js.
• Added a regression test TestSecuritySemanticAnalyzerScansNodeModulesWithinTarget in tests/checks/typescript_semantic_test.go that places a file under node_modules inside a target and asserts the semantic analyzer reports the security.typescript.insecure-tls finding.
• Preserved existing protections: declaration-file filtering, script flavor detection, and the requirement that analyzed files lie within the configured target directory.

Testing

• Ran go test ./tests/checks -run 'TestSecurity(SemanticAnalyzerScansNodeModulesWithinTarget|CheckUsesSemanticTypeScriptAnalyzerForRequirePropertyAlias)$' -count=1, and the tests passed.
• Ran go test ./internal/codeguard/checks/support ./internal/codeguard/checks/security, and the support package tests passed while security contained no test files to run.

---

Codex Task