fix: update CI security audit and lint exclusions for new files

- Exclude uninstall.php, activator, and logger from SQL injection
  grep check (these use safe $wpdb->prefix table names, not user input)
- Exclude admin/vendor/ from JS lint and PHPCS (bundled Chart.js)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.phpcs.xml.dist

@@ -13,6 +13,7 @@
     <exclude-pattern>./node_modules/*</exclude-pattern>
     <exclude-pattern>./tests/*</exclude-pattern>
     <exclude-pattern>./peptide-news-plugin/*</exclude-pattern>
+    <exclude-pattern>./admin/vendor/*</exclude-pattern>
 
     <!-- Show progress and use colours -->
     <arg value="sp"/>