SAST reporting false new regressions

This MR is reporting 67 new regressions: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/17489

SAST Job output: https://gitlab.com/gitlab-org/gitlab-ce/-/jobs/55420085

@connorshea also reported this MR: https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/4496 where a lot of advisories seem to be introduced, but it's because the MR falls behind master by 2000 commits.