feat(core): Security audit

[ivov]

This PR adds functionality to generate a security audit, with five reports:

• credentials risk report
  • Credentials not used in any workflow
  • Credentials not used in any active workflow
  • Credentials not used in recently executed workflows
• database risk report
  • Expressions in "Execute Query" fields in SQL nodes
  • Expressions in "Query Parameters" fields in SQL nodes
  • Unused "Query Parameters" fields in SQL nodes
• filesystem risk report
  • Nodes that interact with the filesystem
• nodes risk report
  • Official risky nodes
  • Community nodes
  • Custom nodes
• instance risk report
  • Unprotected webhooks in instance
  • Outdated instance
  • Security settings (omitted on cloud)

Each report contains title, description, recommendation and location (flagged node or credential), settings (instance security settings) or details (for custom and community nodes)

Functionality exposed via:

• CLI command: ./packages/cli/bin/n8n audit
• Public API: POST /audit (owner only)
• n8n node: audit:generate operation

Spec:

• None, loosely based on RFC.

Out of scope, to cover in future if useful:

• Community nodes not used in recently executed workflows
• Community node installed despite being in n8n's denylist
• Custom nodes not used in recently executed workflows
• Expressions suspected of attempting RCE
• "Execute Query" fields suspected of attempting SQL injection
• Nodes and creds whose config disables SSL
• Settings for NODE_FUNCTION_ALLOW_BUILTIN and NODE_FUNCTION_ALLOW_EXTERNAL
• Report in other formats like HTML

[janober]

Got released with n8n@0.210.0