docs(security): triage log for 5 Dependabot alerts (2 closed, 3 deferred)

Records the 2026-04-18 triage of the 5 open low-severity Dependabot
alerts on hyperpolymath/standards:

- Closed: 2× rustls-webpki advisories (GHSA-xgp8 + GHSA-965h) via the
  0.103.12 lockfile bump in the preceding commit.
- Deferred: 3× rand (<0.9.3) advisories (GHSA-cq8v) in k9-sign /
  k9-init / enterprise-service. Deferral reason captured per manifest
  — all three are either blocked by upstream ecosystem (ed25519-dalek
  3.x still pre-release; tera 1.x + axum-test still pin rand 0.8)
  or non-reachable (advisory only fires when a custom global logger
  re-enters rand::rng(), which none of the three codebases do).

Keeps a durable record so the next security review sees what was
triaged, why, and under what re-evaluate trigger.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

SECURITY-ADVISORIES.adoc

@@ -0,0 +1,59 @@
+// SPDX-License-Identifier: PMPL-1.0-or-later
+// (MPL-2.0 is automatic legal fallback until PMPL is formally recognised)
+// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+
+= Security advisories — triage log
+:toc:
+:toclevels: 2
+
+Triaged record of open / deferred / closed Dependabot advisories against
+`hyperpolymath/standards`. Updated whenever an advisory is resolved or a
+deferral is re-evaluated.
+
+== Closed
+
+=== GHSA-xgp8-3hg3-c2mh + GHSA-965h-392x-2mh5 (rustls-webpki, low, 2026-04-18)
+
+`rustls-webpki` 0.103.10 → 0.103.12 in
+`rhodium-standard-repositories/satellites/rsr-certifier/Cargo.lock`.
+Transitive dep, Cargo.lock-only bump. Both advisories closed by the
+same upstream patch level.
+
+== Deferred (with reason)
+
+=== GHSA-cq8v-f236-94qc — `rand` < 0.9.3 (3 locations, low, triaged 2026-04-18)
+
+*Advisory:* `rand::rng()` is unsound when a custom global logger
+invokes the default RNG from inside its logging hook. First patched
+version: `rand` 0.9.3. Severity: low.
+
+*Affected manifests, and exposure assessment:*
+
+[cols="1,2,1,3"]
+|===
+|Manifest |Path to `rand` |Exposure |Blocker
+
+|`k9-svc/k9-sign/Cargo.toml`
+|Direct declaration (`rand = "0.8"`) + `ed25519-dalek` 2.2 for Ed25519 keygen.
+|Production. Uses `rand::rngs::OsRng` as the CSPRNG for signing-key generation — never invokes the global `rand::rng()` path that the advisory targets.
+|`ed25519-dalek` 2.x requires `rand_core` 0.6; only `ed25519-dalek` 3.0 (currently pre-release `3.0.0-pre.6`) uses `rand_core` 0.9. Stable-track upgrade blocked until `ed25519-dalek` 3.x stabilises upstream.
+
+|`k9-svc/tools/src/k9-init/Cargo.lock`
+|Transitive via `tera` 1.20 → `rand` 0.8.5; also `phf_generator` → `chrono-tz-build` (build-dep only).
+|Build-time / template-render only. `k9-init` does not install a custom global logger.
+|`tera` 1.x still pins `rand` 0.8. Fix requires upstream `tera` 2.x migration (or a replacement template engine).
+
+|`rhodium-standard-repositories/examples/enterprise-service/Cargo.lock`
+|Dev-dependency via `axum-test` → `rust-multipart-rfc7578_2`.
+|Test-time only. `enterprise-service` does not ship any binary that embeds `axum-test`.
+|`rust-multipart-rfc7578_2` still depends on `rand` 0.8. Fix requires upstream (or replacing `axum-test` in dev-deps).
+|===
+
+*Re-evaluate trigger:* once `ed25519-dalek` 3.0 goes stable OR
+`tera` / `axum-test` upstream publish a release that uses `rand` 0.9+,
+re-run the triage and either bump or re-defer.
+
+*Decision:* Deferred. All three exposures are either non-reachable
+(none of the three codebases installs a custom global logger that
+re-enters the RNG) or non-production (dev-dep / build-dep only). Low
+severity is consistent with that residual-risk picture.