Fix: Trivy false positive — HubSpot form-id flagged as "HubSpot API token"

Problem: Trivy's hubspot-api-token rule flags <HubSpotForm form-id="…"> in nuxt/pages/changelog/[...slug].vue. A form-id is a public identifier, not a secret.

Fix: Path-scoped ignore in .github/.trivyignore.yaml:

secrets:
  - id: hubspot-api-token
    paths:
      - "nuxt/pages/**"
      - "nuxt/components/**"
    statement: HubSpot form IDs are public form identifiers, not API secrets

Keeps the rule active everywhere else. A regex allow-rule can't work here — Trivy only tests it against the bare UUID, which is indistinguishable from a real key.