security(ci): exclude docs/changelog.md + SECURITY-*.md from scan-pr

[skhaitan]

Summary

Step 4 Bundle 1b — extend the scan-pr exclude list in security-precommit.yml to cover docs/changelog.md, SECURITY-*.md, and MALWARE-*.md.

Why

The case-block in security-precommit.yml skips IoC pattern matching for known detection-rule files (e.g. .gitleaks.toml, docs/incident-*). It didn't yet cover:

• docs/changelog.md — every changelog entry references the 2026-04-30 incident IoC strings (_$_1e42, 9-3900, Tgw(2509), bsc-dataseed) as part of the changelog narrative. Every PR that adds a changelog entry was failing scan-pr for this reason. Most recently this blocked Sagar's 14 mobile-app endpoint PRs (#936–#955) and Chris's #961.
• SECURITY-INCIDENT-*.md, SECURITY-AUDIT-*.md, SECURITY-EXCEPTIONS*.md, SECURITY-POSTMORTEM-*.md — same shape; root-level security docs reference incident strings.
• MALWARE-*.md — same.

These are the canonical homes for incident documentation; they should never be flagged by the IoC scanner.

Test plan

• CI: scan-pr passes on this PR (which itself modifies .github/workflows/security-precommit.yml — already excluded by the existing .github/workflows/security-* pattern)
• After merge, Sagar's PRs #936–#955 will turn green on scan-pr

🤖 Generated with Claude Code