docs: add Payload CMS case study

[raj-krr]

Summary

Adds a new Payload CMS case study based on a verified scan of a real-world pnpm workspace monorepo.

Changes

• Added examples/payload/ lockfile snapshot:
  • package.json
  • pnpm-lock.yaml
• Added website/docs/case-studies/payload.md
• Added Payload CMS case study to the documentation sidebar
• Updated examples/readme.md
• Updated CHANGELOG.md

Verification

• Verified scan using CVE Lite CLI v1.22.0
• Verified pnpm audit comparison
• Recorded baseline findings and remediation attempt results
• Build passes successfully (npm run build)

Notes

This case study highlights:

• Workspace-scoped pnpm --filter remediation commands
• Direct vs transitive vulnerability findings
• Deduplicated package reporting compared with pnpm audit
• A remediation attempt where findings remained present after upgrade, demonstrating real-world monorepo remediation challenges

[sonukapoor]

The case study content looks solid. One thing to fix: please revert the CHANGELOG.md change - we manage the changelog at release time. Once that's reverted, this is ready to merge.

[raj-krr]

The case study content looks solid. One thing to fix: please revert the CHANGELOG.md change - we manage the changelog at release time. Once that's reverted, this is ready to merge.

Thanks for the review! I've reverted the CHANGELOG.md change and pushed the update.

[sonukapoor]

Thanks for the case study contribution. A note for this PR and future ones: please only touch files specific to your study — the case study document, fixture files, and logo. Do not modify these shared files:

• website/docs/case-studies/index.md
• website/sidebars.ts
• README.md
• examples/readme.md
• CHANGELOG.md
• package.json / package-lock.json

When multiple case study PRs are open at the same time, all of them touch these files and conflicts pile up. Maintainers add the index/sidebar/README entries when merging. We have updated CONTRIBUTING.md to document this.

For this PR specifically: please rebase against main and resolve any conflicts, keeping the main branch version of the shared files.

[raj-krr]

@sonukapoor
Thanks for the feedback! I've rebased the branch against the latest main and removed the shared-file changes from the PR.

The PR is now scoped to the Payload-specific files only:

• examples/payload/package.json
• examples/payload/pnpm-lock.yaml
• website/docs/case-studies/payload.md
• website/static/img/payload-logo.svg

Please let me know if there's anything else you'd like adjusted.

[sonukapoor]

Clean - only touches Payload-specific files. Fixture works correctly (2,602 packages). Approved.

[sonukapoor]

Merged - thank you @raj-krr!