Add deepref fixed version references

[cookesan]

Adds deepref fixed version references to GHSA-7c7g-72q7-4xhm.

Audit refresh, July 8, 2026:

• Confirmed the live PR is open, ready for review, merge-clean, and the visible advisory check is green.
• Rechecked the merge-base diff: exactly one advisory JSON file changes (advisories/github-reviewed/2021/10/GHSA-7c7g-72q7-4xhm/GHSA-7c7g-72q7-4xhm.json), JSON parses, git diff --check passes, and the exact-head worktree is clean.
• Revalidated the added public references and package-version evidence in the diff; all resolve through their source site or registry.

[cookesan]

Rechecked this PR while keeping the open Advisory Database queue current.

• The patch changes the deepref range endpoint from last_affected: 1.2.1 to fixed: 1.2.2.
• deepref@1.2.2 exists in the npm registry, and the v1.2.2 Git tag resolves.
• The patch also splits the malformed combined WhiteSource/GitHub reference into separate references, and the added commit resolves to 24935e6a1060cb09c641d3075982f0b44cfca4c2.

The head advisory JSON validates against the OSV schema.