fix: temporarily safelist unreleased Python tarfile fix

[benbrasso]

Summary

Work for #8109. Unblock the NOFO dev deployment scan failing on CVE-2026-87910 in CPython 3.14.8 by syncing the documented temporary exception already merged in HHS/simpler-grants-pdf-builder#1017.

Changes proposed

Add one CVE safelist entry to the root .grype.yml, with advisory and backport references, the date checked, and removal criteria. This follows the existing policy for fixes unavailable on our Python runtime line. It suppresses this finding; it does not patch the runtime vulnerability.

Context for reviewers

The failed dev deployment job reports Python 3.14.8 as affected and lists fixes in 3.12.15, 3.13.16 and pre-release 3.15.0. The 3.14 backport merged after the 3.14.8 release; the release announcement lists this fix for 3.10–3.13 only. Remove the exception once python:3.14-slim contains the backport and Grype recognizes the fixed version.

The deployment workflow checks out this repository's scan configuration, so the PDF Builder change alone did not update the deployment scan. After merge, start a new dev deployment run from the updated main branch; rerunning the old workflow run may retain its old configuration.

Validation steps

• Grype 0.119.0 loaded the updated configuration and recognized the exception.
• git diff --check passed.
• Confirmed the added block exactly matches PDF Builder [Task]: Task breakdown for ELT decision #1017, whose Anchore scan passed; rebased PDF Builder [Issue 963] Moves ECS services into private subnets #1014 also passed Anchore.
• Application code and scan thresholds are unchanged. The actual deployment scan has not been rerun as part of this PR.

[prasnava]

👍