chore: add expiry date to CVE-2026-1615 in .trivyignore

CVE-2026-1615 (jsonpath Arbitrary Code Execution) was missing a Trivy
exp: field despite having a comment expiry of 2026-03-19. Fix confirmed
pending in upstream (latest: 1.3.0); setting exp:2026-09-16 to track.

Author: sophia-chen-ttd

.trivyignore

@@ -5,9 +5,8 @@
 # CVE-2022-3996
 
 # CVE-2026-1615: HIGH - jsonpath 1.2.1 - Arbitrary Code Execution via unsafe JSON path evaluation
-# No fix available (latest version 1.2.1 is affected). Tracked in UID2-6610.
-# Expiry: 2026-03-19
-CVE-2026-1615
+# No fix confirmed in 1.3.0 (latest). Tracked in UID2-6610.
+CVE-2026-1615 exp:2026-09-16
 
 # zlib contrib/untgz demo utility buffer overflow - not exploitable; Alpine does not ship the untgz binary.
 # See: UID2-6704