chore: Add qa/fixtures to excluded paths

What does this MR do?

Excludes QA fixtures from SD scanning to avoid noisy vuln reporting

What are the relevant issue numbers?

Does this MR meet the acceptance criteria?

• Changelog entry added
• Security reports checked/validated by reviewer