Document the RustSec audit exception

Author: ewilhelm1979-netizen

AGENTS.md

@@ -68,7 +68,7 @@ Run the relevant subset and explain any skipped command:
 cargo fmt --manifest-path rust/iscy-backend/Cargo.toml -- --check
 cargo clippy --locked --manifest-path rust/iscy-backend/Cargo.toml --all-targets -- -D warnings
 cargo test --locked --manifest-path rust/iscy-backend/Cargo.toml
-cargo audit --file rust/iscy-backend/Cargo.lock
+cargo audit --file rust/iscy-backend/Cargo.lock --ignore RUSTSEC-2023-0071
 cargo deny --manifest-path rust/iscy-backend/Cargo.toml check advisories licenses sources
 make rust-smoke
 make rust-restore-smoke
@@ -78,6 +78,8 @@ docker compose --env-file .env -f docker-compose.yml -f docker-compose.prod.yml
 docker build --file rust/iscy-backend/Dockerfile rust/iscy-backend
 ```
 
+`RUSTSEC-2023-0071` is ignored only because `rsa` is present in the lockfile through the disabled optional `sqlx-mysql` dependency path and is not reachable from any ISCY target. Re-evaluate and remove the exception if dependency features change.
+
 Changes to authorization, tenant scoping, evidence, webhooks, imports, backup/restore, or deployment defaults require focused negative tests in addition to the general suite.
 
 ## Pull-request expectations