Add rand_core advisory references

[cookesan]

Adds rand_core advisory references to GHSA-mmc9-pwm7-qj5w.

Audit refresh, July 8, 2026:

• Confirmed the live PR is open, ready for review, merge-clean, and the visible advisory check is green.
• Rechecked the merge-base diff: exactly one advisory JSON file changes (advisories/github-reviewed/2021/08/GHSA-mmc9-pwm7-qj5w/GHSA-mmc9-pwm7-qj5w.json), JSON parses, git diff --check passes, and the exact-head worktree is clean.
• Revalidated the added public references and package-version evidence in the diff; all resolve through their source site or registry.

[cookesan]

Rechecked this reference-only PR while keeping the open Advisory Database queue current.

• The patch only adds rand_core fix pull request and commit references; it does not change affected ranges, package metadata, or severity.
• Pull request rust-random/rand#853 is merged, and all three added commits resolve in rust-random/rand.
• The commit subjects cover the unaligned memory access and backport context for the advisory.

No other advisory fields are changed.