Add advisory for where_is_waldo (GHSA-r766-3v88-pfcf)

[sevgibson]

Adds the security advisory for the where_is_waldo gem.

• GHSA: GHSA-r766-3v88-pfcf
• Affected: < 0.1.6 — Patched: 0.1.6
• CWE-290 (Authentication Bypass by Spoofing)

The gem's built-in ActionCable connection authenticated from client-supplied request.params[:subject_id] when no authenticate_proc was configured, allowing subject impersonation / cross-account roster disclosure. Fixed in 0.1.6 by failing closed in production.

(A CVE has been requested for this GHSA and can be added once assigned.)

[jasnow]

Please add this at the bottom of file:

notes: |
    - A CVE has been requested for this GHSA and can be added once assigned.

Also remember to add cvss_v2, cvss_v3, cvss_v4 from CVE if they are available.

[sevgibson]

Thanks for the review! Added the notes: block as requested.

Re: CVSS — a CVE has been requested for the GHSA but isn't assigned yet (pending GitHub's review), so no CVE-sourced cvss_v2/v3/v4 scores are available to add. The notes: field documents this; I'll follow up with the CVSS + cve: once the CVE lands. The GHSA itself is rated High (CWE-290, authentication bypass by spoofing).

[jasnow]

LGTM