Record why the starlette advisories are pinned open

tools/requirements-ci.in

@@ -15,3 +15,23 @@
 
 platformio==6.1.19
 gcovr==8.6
+
+# Known advisories in the resolved set, and why they are still here.
+#
+# starlette is pulled in by PlatformIO and currently resolves to 0.52.1, which
+# carries five published advisories: PYSEC-2026-161, -248, -249, -2280 and
+# -2281. All five are flaws in serving HTTP -- Host header validation, request
+# path handling, StaticFiles traversal, and form field limits -- and all are
+# fixed in starlette 1.3.1 or earlier.
+#
+# They are not reachable here. PlatformIO lists starlette under "PIO Home
+# requirements" and imports it only in platformio/home/run.py, the local web UI
+# behind `pio home`. CI runs pio test, pio run and pio check, none of which
+# start that server; the one other reference, in platformio/compat.py, is a
+# threadpool shim on the Python < 3.9 branch that 3.12 never takes.
+#
+# There is no version to move to. PlatformIO 6.1.19 is the current release and
+# requires starlette >=0.19,<0.53, so every fixed version is outside the range
+# it will accept. The advisories are left visible in code scanning rather than
+# dismissed, and close on their own once PlatformIO widens that constraint and
+# this lock is regenerated.