Suppress the DeepSource md5() false positive on the cache-version hash

DeepSource: PHP fails this PR on PHP-A1004 ("Use of insecure md5() function")
at the new update_css_version() call. It is a false positive: the value is a
12-character content-derived cache-busting token written to
frm_last_style_update, not a password. The check's suggested remedy,
password_hash(), is salted and non-deterministic, so it would defeat the entire
mechanism -- the whole point is that identical stylesheet bytes must reproduce
an identical version string.

Suppressed at the line rather than repo-wide, following the existing skipcq
convention in this codebase (classes/views/frm-entries/show.php,
classes/views/frm-fields/back-end/field-options.php, and the phpcs-sniffs
CommentSpacingSniff which explicitly whitelists skipcq: comments). Note that
classes/models/ already contains seven md5()-for-cache-key calls of exactly this
kind (FrmAddon, FrmAntiSpam, FrmApplicationApi, FrmFormApi, FrmFormTemplateApi,
FrmStyleApi, FrmUsage), none annotated -- DeepSource only reports on lines the
diff touches, which is why this one surfaced and those did not.

The remaining DeepSource findings on this PR are all in tests/phpunit/, which is
what #3269 addresses; this commit does not duplicate that change.

Verified: php -l clean; the custom Formidable.Commenting.CommentSpacing sniff
passes on the file; php-cs-fixer --dry-run --allow-risky=yes exits 0 against the
LF form CI analyses (the working tree is CRLF via autocrlf, which cs-fixer
reports on its own and is unrelated to this change).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: njonesfermoy2011-rgb

classes/models/FrmStyle.php

@@ -454,6 +454,11 @@ public function save_settings() {
 	 * @return void
 	 */
 	private static function update_css_version( $css ) {
+		// skipcq: PHP-A1004 -- md5() here is a content-derived cache-busting token, not a
+		// password hash. It must be deterministic so the same stylesheet always yields the
+		// same URL; password_hash() is salted and non-deterministic and would defeat the
+		// whole mechanism. Matches the existing md5()-for-cache-key calls in FrmAddon,
+		// FrmAntiSpam, FrmFormApi and FrmStyleApi.
 		update_option( 'frm_last_style_update', substr( md5( $css ), 0, 12 ) );
 	}