Backport of security: triage false positive for go-jose/v3 into relea…

…se/1.17.x (#20904)

backport of commit c8d6b25

Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>

.release/security-scan.hcl

@@ -67,4 +67,15 @@ binary {
 			]
 		}
 	}
+
+	# Triage items that are _safe_ to ignore here. Note that this list should be
+	# periodically cleaned up to remove items that are no longer found by the scanner.
+	triage {
+		suppress {
+			# N.b. `vulnerabilites` is the correct spelling for this tool.
+			vulnerabilites = [
+				"GO-2024-2631", # go-jose/v3@v3.0.3 (false positive)
+			]
+		}
+	}
 }

scan.hcl

@@ -22,4 +22,15 @@ repository {
   secrets {
     all = true
   }
+
+  # Triage items that are _safe_ to ignore here. Note that this list should be
+  # periodically cleaned up to remove items that are no longer found by the scanner.
+  triage {
+    suppress {
+      # N.b. `vulnerabilites` is the correct spelling for this tool.
+      vulnerabilites = [
+        "GO-2024-2631", # go-jose/v3@v3.0.3 (false positive)
+      ]
+    }
+  }
 }