Build/Test Tools: Ignore PHPCS Security Advisory CVE-2026-67434

Add an ignore for GHSA-hmqg-cxww-wqhq (CVE-2026-67434), under both its GitHub and Packagist advisory IDs.

WordPress tooling does not use the vulnerable `Gitblame`, `Hgblame` or `Svnblame` report formats, so the pinned version poses no practical risk.

Merges [63037] to the 6.5 branch.

Props johnbillion, joedolson, jonsurrell, sergeybiryukov.
Fixes #65822.


git-svn-id: https://develop.svn.wordpress.org/branches/6.5@63043 602fd350-edb4-49c9-b593-d223f7449a82

Author: jeremyfelt

composer.json

@@ -23,7 +23,7 @@
 		"yoast/phpunit-polyfills": "^1.1.0"
 	},
 	"config": {
-		"audit": { "ignore": [ "GHSA-3pwp-g2mj-5p3v" ] },
+		"audit": { "ignore": [ "GHSA-3pwp-g2mj-5p3v", "GHSA-hmqg-cxww-wqhq", "PKSA-rdkp-vv9z-mjkg" ] },
 		"allow-plugins": {
 			"dealerdirect/phpcodesniffer-composer-installer": true
 		}