Keep the JS-bundle scan check size-agnostic so the baseline does not drift (#6770)

check_js_file put the bundle's KB size inside the finding's check label, which is
part of the baseline match key (package, file, check). When tensorboard's
projector_binary.js grew from 1918 KB to 1933 KB, the reviewed baseline entry stopped
matching and the benign HIGH resurfaced, red-failing the studio and extras
scan-packages shards. Move the size into the evidence field (shown for review, not
matched) and keep the check label constant, then update the one tensorboard baseline
entry to the size-agnostic label. The finding is suppressed again and will not
re-break when the bundle grows by a few KB. Scanner self-tests pass unchanged.

Co-authored-by: danielhanchen <michaelhan2050@gmail.com>

scripts/scan_packages.py

@@ -1208,9 +1208,10 @@ def check_js_file(content: str, filename: str, package: str) -> list[Finding]:
                 HIGH,
                 package,
                 filename,
-                f"Python wheel ships large ({len(content) // 1024} KB) JS bundle "
-                "(uncommon; manually review)",
-                "",
+                # Size stays in evidence, not the check label, so the baseline key
+                # does not drift when a wheel's bundle grows by a few KB.
+                "Python wheel ships large JS bundle (uncommon; manually review)",
+                f"{len(content) // 1024} KB JS bundle",
             )
         )
     return findings

scripts/scan_packages_baseline.json

@@ -1181,7 +1181,7 @@
     {
       "package": "tensorboard",
       "file": "tensorboard/plugins/projector/tf_projector_plugin/projector_binary.js",
-      "check": "Python wheel ships large (1918 KB) JS bundle (uncommon; manually review)",
+      "check": "Python wheel ships large JS bundle (uncommon; manually review)",
       "severity": "HIGH",
       "evidence": ""
     },