fix: narrow osv-scanner ignore to specific ajv vulnerability only

Replace blanket bun.lock ignore with osv-scanner.toml targeting only
GHSA-2g4f-4pwh-qvx6 (ajv 6.12.6 ReDoS). Expires 2026-06-01.
Other vulnerabilities in bun.lock will now be reported normally.

Author: gisk0

.trunk/trunk.yaml

@@ -29,9 +29,6 @@ lint:
       paths:
         - node_modules/**
         - dist/**
-    - linters: [osv-scanner]
-      paths:
-        - bun.lock # ajv 6.12.6 ReDoS (GHSA-2g4f-4pwh-qvx6) — transitive dep, no upgrade available
 actions:
   disabled:
     - trunk-check-pre-push # Disabled in favor of trunk-check-all-pre-push

osv-scanner.toml

@@ -0,0 +1,4 @@
+[[IgnoredVulns]]
+id = "GHSA-2g4f-4pwh-qvx6"
+reason = "ajv 6.12.6 ReDoS via $data option — transitive dep, no upgrade path available"
+ignoreUntil = 2026-06-01