Add KICS config to document accepted security exceptions

Excludes the following queries with documented reasons:
- Shared volumes: Required for database persistence
- Passwords in config: Local dev only, prod uses K8s secrets
- Healthcheck on init container: Not applicable, exits after setup
- Apt pin version: Intentional for security updates

.gitlab-ci.yml

@@ -25,6 +25,8 @@ stages:
 
 kics:
   allow_failure: true
+  variables:
+    KICS_CONFIG: kics.config
 
 hadolint:
   allow_failure: true