Add reference link to GHSA-vqf4-7m7x-wgfc.json

[0bi0]

The advisory currently references the v1.8.1 release tag but is missing the
underlying patch commit. Added the fix commit for CVE-2025-12183:

yawkat/lz4-java@d041c28

This helps downstream readers verify the exact change that resolved the
out-of-bounds memory operations vulnerability.

[JonathanLEvans]

Hi @0bi0,

Could you explain how you determined yawkat/lz4-java@d041c28 to be the fix commit?

[0bi0]

@JonathanLEvans It seems like I accidentally pushed the wrong commit reference, haha. The correct fix commit is actually 8b4f4c0, which is where the security-relevant change in LZ4Factory.java lives. d041c28 (what I originally referenced) is just a build/packaging change that happens to be the release tag tip. I've updated the PR with the correct commit reference. 👍