Document CodeQL alert #11 as a false positive

[Copilot]

This PR addresses code scanning alert #11 by reviewing the flagged workflow path and confirming the finding is a false positive. No repository files were changed.

• Assessment

  • Reviewed the actions/cache-poisoning/direct-cache finding in .github/workflows/main.user.js_version_update_and_sync_zh-TW.yaml
  • Confirmed the cached contents are limited to APT package archives and are not derived from untrusted PR input

• Why this is not exploitable

  • The workflow only runs via schedule and workflow_dispatch
  • The sync_zh_tw job checks out a commit SHA produced earlier in the same workflow from trusted repository state
  • The cache key is based on apt-packages.txt, not attacker-controlled content

• Repository changes

  • No code or workflow changes
  • PR description/progress updated to record alert 增补词条/修复词条 #11 as a false positive

on:
  schedule:
    - cron: "0 16 * * 0"
  workflow_dispatch:

- name: Checkout files
  uses: actions/checkout@v7
  with:
    ref: ${{ needs.update_main.outputs.commit-sha }}

- name: Cache apt packages
  uses: actions/cache@v6
  with:
    path: /var/cache/apt/archives/*.deb