GHSA-7gfh-x38p-prh3: add reporter's technical analysis as a reference

[cuauht]

Adds one WEB reference to GHSA-7gfh-x38p-prh3 (velocity.js RCE via
property-read to the Function constructor).

Disclosure: I am adding a link to a writeup on my own company's site. My
cofounder, @cruzryan, is the credited reporter on this advisory, so this is our
analysis of our own finding rather than third-party commentary.

What it adds that the current references do not. The advisory currently
links the upstream advisory, PR #192, the fix commit, the package, and the
v2.1.7 release tag. All five describe that the bug was fixed. None of them
walk the exploit chain. The writeup covers:

• why isBlockedPathKey() in set.cjs does not protect the read path in
  references.cjs, which is what made the GHSA-j658-c2gf-x6pq fix incomplete
• the two property reads ($x.constructor.constructor) that reach the
  Function constructor, with the line numbers in 2.1.6
• the reproduction and the shape of the 2.1.7 fix

Reference: https://hackzero.ai/learn/velocity-js-rce

There is precedent for prose analysis in the reference list: GHSA-hw8r-x6gr-5gjp
carries a third-party gist for the same purpose.

I have not added this link to any advisory we did not report.