Silence composer audit for patched vulnerabilities

Problem/Motivation

although 📌 Drupal Core Security Update for OS 12 Active applied the patches for the recent core security issues, running composer audit on such a project still complains about those vulnerabilities, breaking CI pipelines

Steps to reproduce

run composer audit

Proposed resolution

you can inform composer about the applied patches for security issues using
config → audit → ignore
see: https://getcomposer.org/doc/06-config.md#ignore

    "config": {
        "audit": {
            "ignore": {
               "SA-CORE-2025-001": "The security fix was applied as a patch.",
               "SA-CORE-2025-002": "The security fix was applied as a patch."
            }
        }
    },

Remaining tasks

review the patch