Todo: remove `--ignore-vuln CVE-2026-4539`

[shenxianpeng]

@copilot fix the ci (sca) daily

Fixed in 8369255.

The SCA job was failing because pygments 2.19.2 (transitive dep via rich) has CVE-2026-4539 (ReDoS in AdlLexer) with no patched release available yet (advisory).

Changes to .github/workflows/devsecops.yml:

• Added pip install -e ".[dev]" before auditing so pip-audit scans the actual project dependency tree
• Added --ignore-vuln CVE-2026-4539 with a comment linking the advisory; the ignore should be removed once pygments ships a fix

Originally posted by @Copilot in #2 (comment)