Document CodeQL alert #3 as a false positive

[Copilot]

This PR addresses code scanning alert #3 (py/clear-text-logging-sensitive-data). Review of the flagged path showed the alert is not exposing secret material; it matches on a variable name that refers to a Secret Manager identifier, not the secret value.

• Finding

  • The alert in functions/main.py flags a log statement that references google_search_engine_id_secret_id.
  • That variable contains the constant secret name ("GOOGLE_SEARCH_ENGINE_ID"), not the value returned from Secret Manager.

• Assessment

  • get_secret(...) in functions/utils.py returns the actual secret payload.
  • The payload is assigned to search_engine_id and is not logged.
  • The flagged log line emits only the missing secret identifier and project id for diagnostics.

• Result

  • No source changes were required.
  • The PR records alert #3 as a false positive so it can be handled appropriately in review.

google_search_engine_id_secret_id = "GOOGLE_SEARCH_ENGINE_ID"
search_engine_id = get_secret(google_search_engine_id_secret_id, project_id)

logging.error(
    f"Secret {google_search_engine_id_secret_id} not found in project {project_id}."
)