ignore CVE-2022-27311 (#17527)

The discussion on the gibbon PR (321) suggests the following:

-  this would only be a problem if you accepted an API key via user
input
- That's correct, I implemented what I believe is a complete fix in
3.4.4.

This conflicts with the github advisory (and bundle audit).

We do accept mailchimp api keys from user input (restricted to
the admin area).

It looks like the underlying conflict is around domain
include?(api.mailchimp.com) permitting matches that aren't
authoritative (for example, api.mailchimp.completelyhijacked.xyz would
"include?" the right domain).

.travis.yml

@@ -82,7 +82,7 @@ jobs:
       script:
         - yarn lint:frontend
         - yarn test --colors
-        - bundle exec bundle-audit check --update
+        - bundle exec bundle-audit check --update --ignore=CVE-2022-27311
         - bin/test-console-check
         - yarn build-storybook
         - NODE_ENV=production RAILS_ENV=production bundle exec rake assets:precompile