Added retire.js

[pebble-fish]

This pull request introduces retire.js (https://github.com/RetireJS/retire.js) as a security testing tool for the repository. retire.js scans Javascript files in the project and identifies the use of third-part libraries with known security vulnerabilities.

Evidence of Successful Installation

• retire.js was installed via npm
• generated output file is saved as retire-report.json in the PR

Evidence of Tool Execution

• I ran the command retire --outputformat json > retire-report.json to generate the output file. If you want to see the output directly in the terminal, you can simply run retire.

Pros of retire.js

1. detects vulnerable frontend libraries: the package specifically targets client-side JavaScript libraries, often overlooked by dependency scanners, which makes it useful for identifying vulnerabilities in bundled or vendored libraries.
2. it works without relying on package manifests: it is able to detect libraries even if they are copied directly into the repository or included in build assets.
3. simple to use: unlike other libraries that we tested, retire.js could be directly used with minimal configuration and run with a single command, making it easy to integrate into development workflows or CI pipelines.

Cons of retire.js

1. limited scope in newer versions: recent versions no longer directly scan node packages, which means vulnerabilities in node_modules must be detected using other tools such as npm audit.
2. there is very limited customization: as a tradeoff to how easy it is to set up the tool, retire.js provides fewer configuration options compared to more advanced security scanners. custom rules and deeper dependency analysis is also not easily configurable.
3. retire.js focuses on identifying outdated libraries rather than application-level vulnerabilities (e.g. injection flaws or authentication issues).