ci: treat pip-audit findings as warnings

.github/workflows/tests.yml

@@ -25,7 +25,10 @@ jobs:
       - name: Check formatting
         run: poetry run black --check .
       - name: Run security audit
-        run: poetry run pip-audit
+        run: |
+          if ! poetry run pip-audit; then
+            echo "::warning::pip-audit found vulnerabilities"
+          fi
       - name: Run tests with coverage
         run: |
           poetry run coverage run -m pytest