Ignore CVE-2026-40295 in bundler-audit (#67)

devise 5.0.4 fixes an Open Redirect in the Timeoutable session timeout
handler, but devise_token_auth ~> 1.2 still pins devise < 5. The
:timeoutable module isn't enabled on Shopkeeper, so the affected code
path doesn't exist in this app. Same rationale as the existing
CVE-2026-32700 entry.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: dadachi

config/bundler-audit.yml

@@ -4,3 +4,6 @@
 ignore:
   # devise 5.0.3+ fixes this, but devise_token_auth ~> 1.2 pins devise < 5
   - CVE-2026-32700
+  # devise 5.0.4+ fixes an Open Redirect in Timeoutable; we don't enable
+  # :timeoutable on Shopkeeper, and devise_token_auth ~> 1.2 pins devise < 5
+  - CVE-2026-40295