Security: Track upstream BinSkim BA2008 suppressions for node.exe binaries

### Context
The BinSkim rule `BA2008` (Control Flow Guard check) currently triggers false-positive alerts on official upstream `node.exe` binaries bundled in `vscode-server` across win32-x64 and win32-arm64 variants.

### Problem & Verification
Official Node.js releases are compiled without the `IMAGE_DLLCHARACTERISTICS_GUARD_CF` flag enabled by default. We have verified this via automated PE checks against Node.js distributions.

### Proposed Enhancement
1. Add explicit justification metadata fields to `.gdnsuppress` records for better auditability and compliance tracking.
2. Introduce automated verification workflows to monitor upstream Node.js releases for native CFG adoption, ensuring suppressions are safely cleaned up once upstream support lands.