[GHSA-h2qv-fj59-j46j] Add Netty HAProxy fix commit references

[TayfurYldz]

Summary

Adds the upstream remediation commits for the Netty 4.1 and 4.2 release lines as FIX references for GHSA-h2qv-fj59-j46j.

Evidence

• The advisory records 4.1.135.Final and 4.2.15.Final as the first patched versions.
• Netty PR #16881 fixes the exact successful-parse nested PP2_TYPE_SSL leak described by the advisory by recursively releasing depth-2+ TLVs.
• The 4.1 merge commit bd6214fe1c3bae1d42aad6e372657b5b2c1f5105 is an ancestor of netty-4.1.135.Final.
• The equivalent 4.2 commit 270800e5d336913606493a562c8200ecf321a0c1 is an ancestor of netty-4.2.15.Final and changes the same HAProxyMessage release path.

No affected range, patched version, severity, CWE, package, or vulnerability-description metadata is changed.

Validation

• JSON parse: pass
• git diff --check: pass
• One advisory file changed
• No open competing PR for this GHSA immediately before submission

AI-assisted metadata curation based solely on already-public upstream history; no new vulnerability disclosure or exploit reproduction is claimed.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.