Adding auditing to pip

I just checked pip-audit output for some random image we have, and few 'CVE' caught my attention. One of which, turned out, is just an opinion of 'how things should be in Ansible' (https://github.com/advisories/GHSA-h39q-95q5-9jfp), with extremely worrying description, which turned out to be sec-click-bait (https://github.com/ansible/ansible/issues/67792#issuecomm...). Nevertheless, the CVE is issued and there is no way back - it's FOREVER UNFIXED and SECURITY IS ENRAGED. I saw a lot of 'security officers' who just ignore the matter and have KPI of 'no CVE', which brings us to the problem: one guy screamed 'CVE' and no one else can undo this scream. And there are other guys with power to follow this scream and to break production BECAUSE OF SECURITY.