security/vuxml: Document terraform exclusion bypass

go-slug before v0.18.3, bundled in terraform, does not consistently
match .terraformignore rules against canonically equivalent Unicode
filenames, so files meant to be excluded can end up in uploads to
HCP Terraform or Terraform Enterprise. Fixed in terraform 1.15.9.

Security: CVE-2026-14978
Sponsored by: Netzkommune GmbH