Fail audit on moderate and above vulnerabilities

Set the threshold to "moderate" and above. Currently msvc-dev-cmd has
an issue in transitive dev-dependency "minimist" [1] via somewhat long
chain of dependencies:

  - eslint > file-entry-cache > flat-cache > write > mkdirp > minimist
  - eslint > mkdirp > minimist

In order for this to be resolved all these packages need to do something
about their pinned versions. I don't want to sit there with a red build
because of some possible low-severity prototype pollution in dev
dependency. Anything higher -- okay, I'll look at at, and apply a fix
if necessary. (Maybe we should not audit dev dependencies at all...)

This particular vulnerability can be exploited by an attacker who can
submit a pull request and do "something bad"™ to Actions runners
executing jobs for this repository. However, since it's a dev
dependency, nothing will happen to our users. So we can safely ignore
this advisory.

[1]: https://npmjs.com/advisories/1179

.github/workflows/main.yml

@@ -34,4 +34,4 @@ jobs:
       - name: Check out source code
         uses: actions/checkout@v1
       - run: npm install
-      - run: npm audit
+      - run: npm audit --audit-level=moderate