Request to remove build dependencies in stable releases

I think there's a better way to approach this.

See https://www.drupal.org/docs/develop/git/git-for-drupal-project-maintaine... → :-)

I'm in favor of adding a .gitattributes file that excludes package.json and package-lock.json

Thank you Luke and Mark for your quick response and for suggesting the best approach. Let me try the above .gitattributes file option and rerun the security scan.