docs(security): document no-patch dependency alerts

[yastman]

Summary

Documentation-only PR recording the accepted exposure assessment for two open Dependabot alerts with no upstream patches:

• diskcache CVE-2025-69872 (medium, pickle deserialization) — transitive-only via ragas, not practically exploitable in current configuration
• ragas CVE-2026-6587 (low, SSRF) — eval-only extra, vulnerable module is not imported by project code

Changes

• Add docs/security/no-patch-dependency-alerts.md with alert matrix, exposure assessment, invalidation criteria, monitoring criteria, and dismissal guidance.
• Link the new note from docs/security/public-release-secret-scan.md and docs/README.md.
• Add a short security note near the eval optional extra in pyproject.toml.
• Fix stale coverage omit path: src/evaluation/evaluate_with_ragas.py -> src/evaluation/ragas_evaluation.py.

Verification

• git diff --check
• pyproject.toml parsed with Python tomllib
• Local markdown links resolve
• Pre-commit hooks passed, including TOML check and gitleaks

Related

Refs #2043.

This does not dismiss Dependabot alerts, does not add ignore rules, and does not change dependency versions.