A platform team runs CodeQL with advanced setup on a large JavaScript repository. Their scan produces dozens of alerts in a checked-in `vendor/` directory and in minified `dist/` bundles that they never author or fix directly. These noisy alerts are cluttering the Security tab and slowing analysis. The team wants CodeQL to stop analyzing those directories entirely while continuing to scan the application source. What is the most appropriate way to achieve this?