Add CodeQL comments (microsoft#185735)

Author: alexdima

src/vs/base/worker/workerMain.ts

@@ -55,7 +55,7 @@
 			const func = (
 				trustedTypesPolicy
 					? globalThis.eval(<any>trustedTypesPolicy.createScript('', 'true'))
-					: new Function('true')
+					: new Function('true') // CodeQL [SM01632] fetch + eval is used on the web worker instead of importScripts if possible because importScripts is synchronous and we observed deadlocks on Safari
 			);
 			func.call(globalThis);
 			return true;
@@ -85,7 +85,7 @@
 					const func = (
 						trustedTypesPolicy
 							? globalThis.eval(trustedTypesPolicy.createScript('', text) as unknown as string)
-							: new Function(text)
+							: new Function(text) // CodeQL [SM01632] fetch + eval is used on the web worker instead of importScripts if possible because importScripts is synchronous and we observed deadlocks on Safari
 					);
 					func.call(globalThis);
 					resolve();

src/vs/loader.js

@@ -656,7 +656,8 @@ var AMDLoader;
         try {
             const func = (trustedTypesPolicy
                 ? self.eval(trustedTypesPolicy.createScript('', 'true'))
-                : new Function('true'));
+                : new Function('true') // CodeQL [SM01632] the loader is responsible with loading code, fetch + eval is used on the web worker instead of importScripts if possible because importScripts is synchronous and we observed deadlocks on Safari
+            );
             func.call(self);
             return true;
         }
@@ -705,7 +706,8 @@ var AMDLoader;
                         text = `${text}\n//# sourceURL=${scriptSrc}`;
                         const func = (trustedTypesPolicy
                             ? self.eval(trustedTypesPolicy.createScript('', text))
-                            : new Function(text));
+                            : new Function(text) // CodeQL [SM01632] the loader is responsible with loading code, fetch + eval is used on the web worker instead of importScripts if possible because importScripts is synchronous and we observed deadlocks on Safari
+                        );
                         func.call(self);
                         callback();
                     }).then(undefined, errorback);

src/vs/workbench/services/keybinding/test/node/keyboardMapperTestUtils.ts

@@ -48,7 +48,7 @@ export function assertResolveKeybinding(mapper: IKeyboardMapper, keybinding: Key
 export function readRawMapping<T>(file: string): Promise<T> {
 	return Promises.readFile(FileAccess.asFileUri(`vs/workbench/services/keybinding/test/node/${file}.js`).fsPath).then((buff) => {
 		const contents = buff.toString();
-		const func = new Function('define', contents);
+		const func = new Function('define', contents);// CodeQL [SM01632] This is used in tests and we read the files as JS to avoid slowing down TS compilation
 		let rawMappings: T | null = null;
 		func(function (value: T) {
 			rawMappings = value;