Triage Xray findings for the JS tree against Dependabot

[BernardJen]

Part of the JFrog PoC (Lab271/labs-jfrog-poc#13, Lab271/labs-jfrog-poc#14). SlideCue's role in the PoC is a smaller Xray check: does the scanner say anything useful about a JavaScript tree?

What to do

• Once build-info is published, let Xray scan SlideCue builds in warn mode
• For each finding, classify it: already in this repo's Dependabot alerts? fix available? would we actually act on it?
• Add the results to the findings table in Lab271/labs-jfrog-poc NOTES.md

Read this before drawing a conclusion

SlideCue has ~29 direct dependencies and a mostly build-time tree. If Xray finds nothing here, that does not mean Xray is weak — it may just mean this repo is too thin to judge it on. That ambiguity is tracked as Lab271/labs-jfrog-poc#24, and the honest outcome to report is "couldn't tell", not "found nothing".

The pass threshold for the whole PoC is ≥3 findings across all pilots that are new, fixable, and worth acting on. SlideCue is not expected to carry that alone.