fix(security-scan): update scanner self-exemption allowlists for renamed suite files

The three shell scanners exempt their own adversarial test fixtures by exact
filename; the *.security.test.cjs renames broke those entries, so the PR diff
scan flagged the scanners' own test payloads. Verified locally with all three
scanners in --diff origin/next mode (0 findings) and the security suite
(207/207). The .sh files were missed in the original reference sweep because
the rename grep filtered to .cjs/.yml/.json/.md extensions.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/base64-scan.sh

@@ -156,7 +156,7 @@ should_skip_file() {
   # Skip the scan scripts themselves and test files
   case "$file" in
     */base64-scan.sh) return 0 ;;
-    */security-scan.test.cjs) return 0 ;;
+    */security-scan.security.test.cjs) return 0 ;;
   esac
   # Skip scanner fixture directories — they contain deliberate injection samples
   case "$file" in