add comment about parameters named "code"

javascript/ql/src/semmle/javascript/security/dataflow/UnsafeCodeConstructionCustomizations.qll

@@ -24,6 +24,7 @@ module UnsafeCodeConstruction {
   class ExternalInputSource extends Source, DataFlow::ParameterNode {
     ExternalInputSource() {
       this = Exports::getALibraryInputParameter() and
+      // permit parameters that clearly are intended to contain executable code.
       not this.getName() = "code"
     }
   }