cve: decide the one critical the new grafana brings with it

12.4.9 is what runs now, and its single remaining critical sits in a bundled go
dependency that grafana has to update, not us. Recording it before the scanner
reaches that image, so the count does not go to one and stay there.

Worth noting why it was not in the earlier list: the old scanner did not know
CVE-2025-41115 in grafana 12.0.0 at all. Trivy 0.74.0 found it on the first
round, on an image we were already replacing — an outdated scanner is outdated
detection, which was the argument for bumping it, now with an example.

monitoring/cve/entscheidungen.json

@@ -104,6 +104,15 @@
         "GHSA-r277-6w6q-xmqw"
       ]
     },
+    {
+      "ziel": "grafana/grafana:12.4.9",
+      "art": "hingenommen",
+      "grund": "Die Fassung, auf die wir heute gehoben haben (7 CRITICAL -> 1). Der eine Rest ist GHSA-r277-6w6q-xmqw in github.com/getkin/kin-openapi v0.133.0, einer mitgelieferten Go-Abhaengigkeit - behoben in 0.144.0, aber Grafana muss sie ziehen, wir koennen es nicht. Der Major 13.2.0 wurde gemessen verworfen (HIGH 70 -> 162). Beim naechsten 12er-Patch nachsehen.",
+      "pruefen_am": "2026-09-21",
+      "cves": [
+        "GHSA-r277-6w6q-xmqw"
+      ]
+    },
     {
       "ziel": "oci.element.io/synapse:v1.158.0",
       "art": "hingenommen",