Suppress known VitePress/esbuild advisory in scheduled OSV scan

[Copilot]

The scheduled OSV workflow (scan-scheduled / osv-scan) is failing on a known advisory (GHSA-g7r4-m6w7-qqqr) in the docs dependency tree. This PR scopes an OSV ignore to that advisory so scheduled scans stop failing until the VitePress v2 upgrade path is available.

• Root cause

  • OSV scan is configured with fail-on-vulnerability behavior and flags esbuild in docs/package-lock.json via VitePress v1 transitive dependencies.

• Change

  • Added a docs-local OSV config at docs/osv-scanner.toml.
  • Declared a single [[IgnoredVulns]] entry for GHSA-g7r4-m6w7-qqqr with an explicit temporary rationale.

• Scope / impact

  • Ignore is narrowly scoped to the docs dependency scan path rather than disabling OSV failure behavior globally.
  • Keeps scheduled security scans actionable while avoiding persistent noise from this known upstream constraint.

[[IgnoredVulns]]
id = "GHSA-g7r4-m6w7-qqqr"
reason = "VitePress v1 currently depends on vulnerable esbuild; tracked until VitePress v2 upgrade is available."