Add cdxgen Maven shell advisory references

[cookesan]

Adds cdxgen Maven shell advisory references to GHSA-5vwr-qchf-q4pf.

Audit refresh, July 8, 2026:

• Confirmed the live PR is open, ready for review, merge-clean, and the visible advisory check is green.
• Rechecked the merge-base diff: exactly one advisory JSON file changes (advisories/github-reviewed/2026/06/GHSA-5vwr-qchf-q4pf/GHSA-5vwr-qchf-q4pf.json), JSON parses, git diff --check passes, and the exact-head worktree is clean.
• Revalidated the added public references in the diff; all resolve through their source site or registry.

[cookesan]

Rechecked this reference-only PR while keeping the open Advisory Database queue current.

Adds direct commit and release references for GHSA-5vwr-qchf-q4pf. The advisory already references upstream PR #4059 and package source; this PR links the merged fix to the fixed cdxgen release.

Current audit, July 8, 2026:

• GHSA-5vwr-qchf-q4pf is live, not withdrawn, and has no CVE identifier.
• PR [GHSA-3gv7-3h64-78cm] Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat #4059 merged to master as commit 37cc7d41da83969e18d2ea20ee4cc005902d4f38.
• Release v12.4.3 is published and not marked draft or prerelease.
• npm @cyclonedx/cdxgen 12.4.3 resolves with package tarball and integrity metadata.
• Local JSON validation and whitespace checks pass, and the diff only changes this advisory.

No advisory data fields are changed.