Document CodeQL alert #7 as a false positive

[Copilot]

This PR addresses code scanning alert #7 (py/path-injection). After tracing the flagged path construction in ssltui/ca.py, the alert was determined to be a false positive; no source changes were required.

• Assessment

  • The flagged sink is csr_path.unlink(missing_ok=True).
  • The path is not attacker-controlled in a way that allows traversal outside the CA store.

• Why the alert does not apply

  • config.validate_cn(cn) constrains the common name to valid hostname-style input.
  • config.cert_dir(root, cn) re-validates cn, resolves the resulting path, and enforces that it remains directly under root / "certs".
  • The deleted file is the fixed child cert.csr under that validated certificate directory.

• Change scope

  • No code changes.
  • PR description records the alert as a false positive for reviewer visibility.

cert_dir = config.cert_dir(root, cn)
csr_path = cert_dir / "cert.csr"
csr_path.unlink(missing_ok=True)