Add reference link to GHSA-vqf4-7m7x-wgfc.json

[0bi0]

The advisory currently references the v1.8.1 release tag but is missing the
underlying patch commit. Added the fix commit for CVE-2025-12183:

yawkat/lz4-java@d041c28

This helps downstream readers verify the exact change that resolved the
out-of-bounds memory operations vulnerability.

[JonathanLEvans]

Hi @0bi0,

Could you explain how you determined yawkat/lz4-java@d041c28 to be the fix commit?

[0bi0]

@JonathanLEvans It seems like I accidentally pushed the wrong commit reference, haha. The correct fix commit is actually 8b4f4c0, which is where the security-relevant change in LZ4Factory.java lives. d041c28 (what I originally referenced) is just a build/packaging change that happens to be the release tag tip. I've updated the PR with the correct commit reference. 👍

[github-actions]

👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the Keep label to hold stale off permanently, or do nothing. If you do nothing this pull request will be closed eventually by the stale bot. Please see CONTRIBUTING.md for more policy details.