ci: list the FIPS Dockerfile in the CI coverage allowlist

No pull request job holds the Chainguard token its base image and apk repo need.

.github/ci-coverage-allowlist.yml

@@ -66,6 +66,12 @@ dockerfiles:
       An example image under cookbook/ that is documentation rather than a shipped artifact
     paths:
       - cookbook/litellm-ollama-docker-image/Dockerfile
+  - reason: >-
+      The FIPS image builds on the pinned cgr.dev/berri.ai chainguard-base-fips base and every apk
+      call authenticates to virtualapk.cgr.dev with a Chainguard token supplied as a build secret;
+      no pull request job holds that token, so no job can build it
+    paths:
+      - docker/Dockerfile.fips
   - reason: >-
       The Rust gateway image compiles the whole workspace in release mode, which is too slow for
       a per-pull-request job while the gateway binary is still being assembled; the Rust lint,