Use Go pseudo-version for GHSA-fhh2-gg7w-gwpq

[cookesan]

Updates the Nginx-UI Go affected range to the commit-resolved pseudo-version and adds the upstream fix commit reference. The backup manifest/integrity fix is 0xJacky/nginx-ui@f61bcec, and go list -m -json github.com/0xJacky/nginx-ui@f61bcec547c0 resolves it to v1.9.10-0.20260315015203-f61bcec547c0.

[github-actions]

👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the Keep label to hold stale off permanently, or do nothing. If you do nothing this pull request will be closed eventually by the stale bot. Please see CONTRIBUTING.md for more policy details.

[cookesan]

Rechecked on 2026-07-01: go list -m -json github.com/0xJacky/nginx-ui@f61bcec547c0f305e35348d6440ef156c1d5c3cb resolves to v1.9.10-0.20260315015203-f61bcec547c0 with origin hash f61bcec547c0f305e35348d6440ef156c1d5c3cb. The advisory checks are still green, so this remains current.

[cookesan]

Review note: rechecked this head on 2026-07-07. The PR head JSON validates against the OSV schema, and go list resolves github.com/0xJacky/nginx-ui@f61bcec547c0f305e35348d6440ef156c1d5c3cb to v1.9.10-0.20260315015203-f61bcec547c0 with origin hash f61bcec547c0f305e35348d6440ef156c1d5c3cb. That matches the proposed fixed pseudo-version after dropping the leading v; the advisory alias, severity, package name, and references remain consistent.

[cookesan]

Closing this because upstream/main now already contains the fixed Go pseudo-version 1.9.10-0.20260315015203-f61bcec547c0, the f61bcec547c0f305e35348d6440ef156c1d5c3cb commit reference, and the additional GO-2026-4903 reference. I rechecked the current file and Go module resolution on 2026-07-08, so leaving this PR open would now be redundant.