Remove CVE-2026-82049 exception for Python 3.11.17 once the scanner records the fix #21

The Grype gate fails every Python 3.11.17 build on CVE-2026-82049 (tarfile data/tar filter bypass via a hard link to a symlink, severity High).

Python 3.11.17 already contains the upstream fix: the 3.11 backport was merged on 2026-09-29 and is an ancestor of the v3.11.17 tag. The vulnerability data used by Grype does not list a fixed 3.11 release yet (it lists 3.12.15, 3.13.16 and 3.14.0b1), so the match is a false positive for this version.

.grype.yaml therefore ignores CVE-2026-82049 for the python binary package at exactly version 3.11.17. The rule does not apply to any other version.

Remove the exception when either happens:

• The vulnerability data records a fixed 3.11 release. Check by building a 3.11 image and running the scan without the rule.
• Python 3.11 moves to a newer version. The rule stops matching then, so delete it and confirm the scan passes without it instead of bumping the pinned version.

Delete .grype.yaml if no rules remain.