ci(pip-audit): ignore filelock CVEs in pip-audit's own dependency

pip-audit --local scans the whole audit env, which includes pip-audit's
own CacheControl[filecache] -> filelock 4.1.0. Six new CVEs (fixed in
4.2.1) started failing every run; 4.2+ requires Python 3.11 and the audit
env is 3.10. The bot does not use filelock.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

.gitea/workflows/lint.yml

@@ -94,8 +94,16 @@ jobs:
 
       - name: Audit matrixbot dependencies
         # --local scans the env without spawning a venv (required for standalone Python)
-        # CVE-2026-3219 is in pip itself, not our code — ignore it explicitly
-        run: /opt/python/bin/pip-audit --local --ignore-vuln CVE-2026-3219
+        # CVE-2026-3219 is in pip itself, not our code — ignore it explicitly.
+        # The filelock CVEs (fixed in 4.2.1) are in pip-audit's own dependency
+        # (CacheControl[filecache]); the bot doesn't use filelock, and 4.2+
+        # needs Python 3.11, which this 3.10 audit env can't install.
+        run: >-
+          /opt/python/bin/pip-audit --local
+          --ignore-vuln CVE-2026-3219
+          --ignore-vuln CVE-2026-112906 --ignore-vuln CVE-2026-112907
+          --ignore-vuln CVE-2026-112913 --ignore-vuln CVE-2026-112914
+          --ignore-vuln CVE-2026-112937 --ignore-vuln CVE-2026-112940
 
   secret-scan:
     name: Secret scan (gitleaks)