STAC-25318 Add agent Python VEX statements

[LouisLotter]

Summary

• add image-scoped OpenVEX statements for CVE-2026-15308 and CVE-2026-4360 in the StackState Kubernetes agent
• record both as not_affected with vulnerable_code_not_in_execute_path
• regenerate the VEX repository index

Jira: https://stackstate.atlassian.net/browse/STAC-25318

Evidence

The statements were reviewed against
quay.io/stackstate/stackstate-k8s-agent:3ce0270e and source commit
3ce0270ebe.

• CVE-2026-15308 requires incremental use of
  html.parser.HTMLParser. Full searches of the exact agent release and its
  pinned integrations found no import or use of html.parser or
  HTMLParser.
• CVE-2026-4360 affects tarfile.extract() hardlink handling. The sole
  shipped runtime extraction path accepts only TarInfo.isfile() members,
  renames the selected regular file to bpftool, and extracts only that
  member. Tar hardlinks do not satisfy isfile().

The original work item also listed three containerd v2 advisories that an
earlier Grype database matched to github.com/containerd/containerd v1.7.33.
Current Grype 0.112.0 control scans of both the agent and process-agent images
no longer report those findings. They were corrected upstream and are
intentionally not VEXed here.

Validation

• jq empty pkg/oci/stackstate-k8s-agent/scan.openvex.json
• python3 tools/build_index.py --check
• git diff --check
• raw Grype control: CVE-2026-15308 and CVE-2026-4360 both present
• same exact image and Grype database with this OpenVEX document: neither CVE
  present

Security review is required before merge because these are public
not_affected assertions.

[LouisLotter]

@StackVista/infra-admins Please review these public not-affected statements, including the exact-image before/after Grype evidence in the PR description. Do not merge until the security rationale is accepted.