[GHSA-2xmm-m4wv-3fjh] Add October CMS fix commit reference

[TayfurYldz]

Summary

Adds the upstream commit containing the image-resizer scheme validation fix as a FIX reference for GHSA-2xmm-m4wv-3fjh.

Evidence

• The advisory records october/october 4.3.5 as the first patched version.
• Commit 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58 changes ResizeImageItem::fromObject() from accepting any value containing :// to accepting only HTTP(S), and changes ResizeImages::getSourcePathForResize() to reject unsupported URI schemes. These are the exact code paths described by the advisory.
• The commit is contained in tag v4.3.5 and later 4.3.x releases.

No package, affected range, patched version, severity, CWE, or description metadata is changed.

Validation

• JSON parse: pass
• git diff --check: pass
• One advisory file changed
• No open competing PR for this GHSA immediately before submission

AI-assisted metadata curation based solely on already-public upstream history; no new vulnerability disclosure or exploit reproduction is claimed.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.