CI: suppress js-yaml dev-only OSV advisory GHSA-h67p-54hq-rp68

A newly disclosed moderate DoS in js-yaml (<= 4.1.1) is flagged by OSV-Scanner
against js-yaml@3.14.2, a deep transitive dev dependency from the test-coverage
toolchain (ts-jest -> istanbul -> load-nyc-config -> js-yaml). It is never in
the shipped main.js and only parses our own trusted coverage config. The patch
is js-yaml 4.2.0, but load-nyc-config needs the removed 3.x safeLoad API, so no
non-breaking override exists. Document the acceptance in osv-scanner.toml and
point the scanner at it, rather than dropping the severity gate.

.github/workflows/ci.yml

@@ -120,6 +120,7 @@ jobs:
         uses: google/osv-scanner-action/osv-scanner-action@v2.0.3
         with:
           scan-args: |-
+            --config=osv-scanner.toml
             --lockfile=package-lock.json
             --recursive
 

osv-scanner.toml

@@ -0,0 +1,7 @@
+# OSV-Scanner suppressions. Every entry must document why the advisory is
+# accepted and what would let us drop it. Revisit whenever the dependency tree
+# changes (a new lockfile may remove the transitive path entirely).
+
+[[IgnoredVulns]]
+id = "GHSA-h67p-54hq-rp68"
+reason = "js-yaml quadratic-complexity DoS in merge-key parsing (vulnerable <= 4.1.1, patched in 4.2.0). Reaches this repo only as js-yaml@3.14.2, a deep transitive DEV dependency: ts-jest -> @jest/transform -> babel-plugin-istanbul -> @istanbuljs/load-nyc-config -> js-yaml. It is never in the shipped main.js (esbuild bundles runtime deps only) and parses only our own trusted coverage config, not attacker-controlled input. No non-breaking fix exists: the patch is js-yaml 4.2.0, but load-nyc-config uses the 3.x safeLoad API removed in 4.x, so forcing an override would break the coverage loader. Drop this entry once load-nyc-config moves off js-yaml 3.x or the path leaves the tree."