ci: ignore GHSA-2mjx-qc3c-rqvc in the Trivy lockfile scan, matching the cargo-audit waiver

.trivyignore.yaml

@@ -11,3 +11,9 @@ vulnerabilities:
       `tar` is a build dependency of `libddwaf-sys`, used by its build script.
       It is not linked into the extension binary: `cargo tree -i tar -e normal`
       reports nothing, while `-e build,normal` reports the build-script edge.
+  - id: GHSA-2mjx-qc3c-rqvc
+    statement: |
+      Same advisory as RUSTSEC-2026-0285, ignored for cargo-audit in
+      `bottlecap/.cargo/audit.toml`. The fix is in rustls >= 0.23.45, which
+      requires aws-lc-rs >= 1.18 and so AWS-LC-FIPS 4.x, pending FIPS 140-3
+      certification. Remove this entry together with that ignore.

bottlecap/.cargo/audit.toml

@@ -1,6 +1,7 @@
 # RUSTSEC-2026-0285 is fixed in rustls >= 0.23.45, but that version requires
 # aws-lc-rs >= 1.18, which pulls in AWS-LC-FIPS 4.x, pending FIPS 140-3
 # certification. Remove this ignore once a FIPS-certified aws-lc-rs is
-# available.
+# available. Trivy reports the same advisory as GHSA-2mjx-qc3c-rqvc, ignored in
+# .trivyignore.yaml.
 [advisories]
 ignore = ["RUSTSEC-2026-0285"]