Apply all necessary exclusions to sobelow findings

lib/music_library_web/components/core_components.ex

@@ -133,6 +133,8 @@ defmodule MusicLibraryWeb.CoreComponents do
     """
   end
 
+  # Renders syntax-highlighted JSON from internal debug structs, not user input.
+  # sobelow_skip ["XSS.Raw"]
   defp format_debug_data(%{type: :json, data: data}) do
     data
     |> Jason.encode!(pretty: true)

lib/music_library_web/components/record_form.ex

@@ -430,6 +430,9 @@ defmodule MusicLibraryWeb.Components.RecordForm do
     {:noreply, assign(socket, form: to_form(changeset, action: :validate))}
   end
 
+  # path comes from Phoenix's consume_uploaded_entries callback —
+  # a framework-generated temp file path, not user input.
+  # sobelow_skip ["Traversal.FileModule"]
   def handle_event("save", %{"record" => record_params}, socket) do
     uploaded_covers =
       consume_uploaded_entries(socket, :cover_data, fn %{path: path}, entry ->