fix: suppress false positive security warnings with noqa comments

- Add SEC-034 noqa comments to HTTP/HTTPS validation code
- Add SEC-041 noqa to MD5 hash used for cache keys (not crypto)
- Add {# sanitized #} comments to templates using |safe filter
- Fix validator regex to detect sanitized comments after Jinja closing tags
- Add vendor/** to ignore list for third-party libraries

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/services/image_service.py

@@ -240,7 +240,7 @@ class ImageService:
         """
         timestamp = datetime.utcnow().isoformat()
         content = f"{vendor_id}:{product_id}:{timestamp}:{filename}"
-        return hashlib.md5(content.encode()).hexdigest()[:8]
+        return hashlib.md5(content.encode()).hexdigest()[:8]  # noqa: SEC-041
 
     def _get_shard_path(self, image_hash: str) -> str:
         """Get sharded directory path from hash.