Security scans: skip the build output in CodeQL, note an unfixed zlib bug

- CodeQL no longer scans static/, the minified bundles of frontend/src
  and its npm packages; three.js object ids built with Math.random()
  came back as new insecure-randomness alerts with every build
- Trivy ignores a zlib gz* file API overflow that Debian has not fixed
  yet and nothing in the image calls

.codeql/codeql-config.yml

@@ -3,6 +3,13 @@ name: "Bambuddy CodeQL Configuration"
 # Uses the default query suite with accepted-risk exclusions.
 # Each exclusion is reviewed and documented below.
 
+# static/ is the frontend build output (minified bundles of frontend/src and
+# its npm dependencies). frontend/src is scanned itself; the bundles only add
+# third-party code under a new hashed file name with every build, e.g.
+# three.js's Math.random() object ids reported as js/insecure-randomness.
+paths-ignore:
+  - static/
+
 query-filters:
   # ── Python Accepted Risk ─────────────────────────────────────
 

.trivyignore

@@ -30,3 +30,10 @@ CVE-2026-30997
 # libopenjp2-7 is pulled in transitively by ffmpeg but Bambuddy never
 # decodes JPEG 2000 files (printer thumbnails are PNG, camera is MJPEG/H.264).
 CVE-2026-6192
+
+# zlib gz_write() heap overflow after a failed write() (HIGH). No fixed
+# zlib1g in Debian trixie yet. Not reachable: the bug is in the gz* file API
+# (gzopen/gzwrite), which nothing in the image uses for its data. Python's
+# gzip and zlib modules, Pillow and ffmpeg all go through deflate/inflate.
+# Remove this line once Debian ships the fix.
+CVE-2026-76844