ci: Fail Snyk's SBOM test only on findings the code does not mitigate
Snyk applies no ignore to snyk sbom test: neither a .snyk file nor its
organization policies, which serve Snyk Code alone. The Rust and codec
job's test runs through scripts/ci/snyk-sbom-test.sh, which tests each
SBOM and fails on any finding scripts/ci/snyk-mitigated.json does not
name. Each entry there is an advisory no release fixes, with the code's
mitigation, kept in review with the code; a listed one is reported as a
notice, an entry no SBOM reports once every test ran is a warning to
remove it, and a test that does not run fails the job.
The one entry is CVE-2019-13960 on libjpeg-turbo (both builds), which
the webcam decoder's refusal of progressive JPEGs mitigates, at the
maintainer's word. AGENTS.md states when an advisory is listed there.
Tests: shellcheck, actionlint 1.7.12; the script against the snyk CLI
under the Selkies organization: the two codec SBOMs pass with the
libjpeg-turbo notice; an SBOM of libde265 1.0.8 fails listing its
findings; with the codec SBOMs left out the entry draws the warning.