We should list `SAST_EXCLUDED_PATHS` first as its
the preferred method of excluding variables rather
than analyzer-specific settings