fix(deps): ignore ip-address/undici in dependabot -- nested unreachable copies

[asachs01]

Summary

Unlike other node-* repos in this fleet, node-immybot never had the standard ip-address ignore entry applied, and undici shares the identical shape. Both packages' Dependabot Security update jobs fail silently (security_update_not_possible, no PR ever opens).

Confirmed via package-lock.json: each is node_modules/npm/node_modules/<pkg> (ip-address@10.2.0, undici@6.27.0), nested inside npm's own bundled dependency tree -- npm ships bundleDependencies covering its entire tree, vendored/pre-resolved at publish time. Same mechanism already empirically verified via an overrides-pin test on node-ninjaone: undici in WYRE-AI/node-ninjaone#74, ip-address on 2026-08-06.

Adds ignore rules for both. The underlying GHSA alerts stay visible on the Security tab regardless.

Test plan

• YAML validated
• Confirmed via package-lock.json that both packages' occurrences are under node_modules/npm/, no reachable top-level path
• Config-only change, no source/dependency changes

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[asachs01]

Reviewed (maintainer). Verified against real artifacts, not just the description — new case (never had the ip-address ignore before), checked independently:

• Pulled package-lock.json directly and confirmed both claimed nested-npm-bundled paths at the exact versions: node_modules/npm/node_modules/{ip-address@10.2.0, undici@6.27.0}. Both match the same fleet-wide npm-bundled tree seen across the other 6 repos in this batch.
• Top-level undici in this repo resolves to 6.28.0 (a real, reachable, already-patched copy) — confirms the nested 6.27.0 under npm/ is genuinely unreachable, not a duplicate of something a real override could already fix.
• dependabot.yml-only diff, no source changes, CI green (test 20/22 + release), no branch protection (direct merge).

Verdict: approve