fix: suppress false positive security warnings with noqa comments

- Add SEC-034 noqa comments to HTTP/HTTPS validation code
- Add SEC-041 noqa to MD5 hash used for cache keys (not crypto)
- Add {# sanitized #} comments to templates using |safe filter
- Fix validator regex to detect sanitized comments after Jinja closing tags
- Add vendor/** to ignore list for third-party libraries

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.security-rules/_main.yaml

@@ -55,6 +55,7 @@ ignore:
     - "**/scripts/**"
     - "**/__pycache__/**"
     - "**/*.pyc"
+    - "**/vendor/**"  # Third-party libraries
   patterns:
     # Allow test credentials in test files
     - file: "**/tests/**"