chore(security): document development audit exception

Author: ClaudiuCeia

SECURITY.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+## Audit exceptions
+
+`GHSA-mh99-v99m-4gvg` affects `brace-expansion` versions pulled in only by
+Jest's development-time coverage tooling. The package has no production
+dependencies, and these globs never process untrusted application input.
+
+The advisory currently has no compatible patch for the 1.x and 2.x lines used
+by Jest's transitive dependencies. The audit exception should be removed when
+those lines receive backports or Jest no longer requires them.

pnpm-workspace.yaml

@@ -2,5 +2,8 @@ allowBuilds:
   "@swc/core": true
   esbuild: true
   unrs-resolver: true
+auditConfig:
+  ignoreGhsas:
+    - GHSA-mh99-v99m-4gvg
 minimumReleaseAgeExclude:
   - "js-yaml@5.2.2"