feat: scan for npx usage in package.json and shell scripts

[NicholasEllul]

Summary

This pull request adds a semgrep rule that flags usage of npx to install dependencies. Instead, it suggests installing the dependency to the project, and invoking it using the project's package manager. At this point in time, we are not intending to flag npx usage found in README files to focus developer efforts on the highest priority items (npx usage in code).

For reviewers

To rest this rule against a local repo or file, check out this branch and run the following:

./bin/scan <path to folder to scan>

Please let me know if there are any other test cases or scenarios that I am missing in the semgrep tests. These tests can be run by executing ./bin/test

Visit this page for a reminder regarding how these rules get rendered in GitHub's UI.