fix(utils): annotate the two G304 sites this branch introduced

gosec flags os.Open on a variable path, and both new call sites in ffmpeg.go
are its alerts on this PR. Neither is reachable by an outside caller: isPCM16Wav
opens the exact path it is about to hand ffmpeg as input, which in the upload
path is a server-created temp file named from path.Base of the client name so
no traversal survives, and wavAudioBytes opens AudioResample's own dst, a name
this package derives from src and has just had ffmpeg write.

Annotated in the repo's existing style rather than restructured, with the
reason spelled out, because a bare suppression is worth nothing to the next
reader. The three other G304 sites in this file, in passthroughWAV and
isTargetWav, predate the branch and are left untouched.

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Assisted-by: Claude:claude-opus-5 [Claude Code]

pkg/utils/ffmpeg.go

@@ -117,6 +117,12 @@ func convertWithFFmpeg(src, dst string) error {
 // a failed request, and music files, which are the input this passthrough
 // exists for, are exactly where extensible turns up.
 func isPCM16Wav(src string) bool {
+	// #nosec G304 -- src is the very path the caller is about to hand ffmpeg as
+	// its input, so opening it here reaches nothing ffmpeg would not. In the
+	// upload path it is a server-created temp file whose name is
+	// filepath.Join(server-made dir, path.Base(client name)), so no traversal
+	// survives. This only reads to classify the format, and any error returns
+	// false, which takes the transcode branch rather than the passthrough.
 	f, err := os.Open(src)
 	if err != nil {
 		return false
@@ -185,6 +191,10 @@ func AudioResample(src string, sampleRate int) (string, error) {
 // size and the parsed duration say "audio", and only the file length says the
 // truth. A plain size check does not work either, since the file is not empty.
 func wavAudioBytes(path string) int64 {
+	// #nosec G304 -- the only caller passes AudioResample's own dst, a name
+	// this package derives from src by string substitution and has just had
+	// ffmpeg write. Nothing outside chooses it, and the file being inspected is
+	// one we created moments earlier.
 	f, err := os.Open(path)
 	if err != nil {
 		return -1