chore: add the Ruff suppression nosec/nosemgrep do not cover

Ruff reports S603 on the same call Bandit and Opengrep do, and none of
the three suppressions covers the others. Confirmed the precondition
first: path comes from discover_plugin_tests(), which globs test files
inside the repo, and the call is a fixed interpreter with a list argv
and no shell.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014RRtqXDCnvnY6EQwhT5CV9

scripts/run_plugin_tests.py

@@ -115,7 +115,7 @@ def run_script_tests(test_files: list, verbose: bool = False) -> int:
             # discovered by globbing the repo; argument list, no shell, so
             # nothing is word-split or expanded. Same suppression pair the
             # rest of the repo uses for this shape (see permission_utils.py).
-            proc = subprocess.run(  # nosec B603 - no shell invoked (list-form argv)  # nosemgrep
+            proc = subprocess.run(  # noqa: S603  # nosec B603 - no shell invoked (list-form argv)  # nosemgrep
                 [sys.executable, str(path)],  # nosemgrep
                 cwd=str(Path(path).parent),
                 capture_output=True, text=True, env=env,