feat(validators): add noqa suppression support to security and performance validators

- Add centralized _is_noqa_suppressed() to BaseValidator with normalization
  (accepts both SEC001 and SEC-001 formats for ruff compatibility)
- Wire noqa support into all 21 security and 18 performance check functions
- Add ruff external config for SEC/PERF/MOD/EXC codes in pyproject.toml
- Convert all 280 Python noqa comments to dashless format (ruff-compatible)
- Add site/ to IGNORE_PATTERNS (excludes mkdocs build output)
- Suppress 152 false positive findings (test passwords, seed data, validator
  self-references, Apple Wallet SHA1, etc.)
- Security: 79 errors → 0, 60 warnings → 0
- Performance: 80 warnings → 77 (3 test script suppressions)
- Add proposal doc with noqa inventory and remaining findings recommendations

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/validate/base_validator.py

@@ -66,13 +66,14 @@ class BaseValidator(ABC):
         "site",  # mkdocs build output
     ]
 
-    # Regex for noqa comments: # noqa, # noqa: RULE-001, # noqa: RULE-001, RULE-002
+    # Regex for noqa comments. Supports both ruff-compatible (SEC001) and
+    # human-readable (SEC-001) formats: # noqa: SEC001, # noqa: SEC001
     _NOQA_PATTERN = re.compile(
-        r"#\s*noqa(?::\s*([A-Z]+-\d+(?:\s*,\s*[A-Z]+-\d+)*))?",
+        r"#\s*noqa(?::\s*([A-Z]+-?\d+(?:\s*,\s*[A-Z]+-?\d+)*))?",
     )
-    # Same for HTML comments: <!-- noqa: RULE-001 -->
+    # Same for HTML comments: <!-- noqa: SEC015 -->
     _NOQA_HTML_PATTERN = re.compile(
-        r"<!--\s*noqa(?::\s*([A-Z]+-\d+(?:\s*,\s*[A-Z]+-\d+)*))?\s*-->",
+        r"<!--\s*noqa(?::\s*([A-Z]+-?\d+(?:\s*,\s*[A-Z]+-?\d+)*))?\s*-->",
     )
 
     def __init__(
@@ -191,23 +192,32 @@ class BaseValidator(ABC):
         path_str = str(file_path)
         return any(pattern in path_str for pattern in self.IGNORE_PATTERNS)
 
+    @staticmethod
+    def _normalize_rule_id(code: str) -> str:
+        """Normalize rule ID by removing dashes: SEC-001 → SEC001."""
+        return code.replace("-", "")
+
     def _is_noqa_suppressed(self, line: str, rule_id: str) -> bool:
         """Check if a line has a noqa comment suppressing the given rule.
 
-        Supports:
+        Supports both ruff-compatible and human-readable formats:
           - ``# noqa`` — suppresses all rules
-          - ``# noqa: SEC-001`` — suppresses specific rule
-          - ``# noqa: SEC-001, SEC-002`` — suppresses multiple rules
-          - ``<!-- noqa: SEC-015 -->`` — HTML comment variant
+          - ``# noqa: SEC001`` — ruff-compatible (preferred)
+          - ``# noqa: SEC001`` — human-readable (also accepted)
+          - ``<!-- noqa: SEC015 -->`` — HTML comment variant
         """
+        normalized_id = self._normalize_rule_id(rule_id)
         for pattern in (self._NOQA_PATTERN, self._NOQA_HTML_PATTERN):
             match = pattern.search(line)
             if match:
                 rule_list = match.group(1)
                 if not rule_list:
                     return True  # bare # noqa → suppress everything
-                suppressed = [r.strip() for r in rule_list.split(",")]
-                if rule_id in suppressed:
+                suppressed = [
+                    self._normalize_rule_id(r.strip())
+                    for r in rule_list.split(",")
+                ]
+                if normalized_id in suppressed:
                     return True
         return False