Add zeroconf rdlength advisory references

[cookesan]

Adds zeroconf rdlength advisory references to GHSA-qc2x-6f54-m6h9.

Audit refresh, July 8, 2026:

• Confirmed the live PR is open, ready for review, merge-clean, and the visible advisory check is green.
• Rechecked the merge-base diff: exactly one advisory JSON file changes (advisories/github-reviewed/2026/06/GHSA-qc2x-6f54-m6h9/GHSA-qc2x-6f54-m6h9.json), JSON parses, git diff --check passes, and the exact-head worktree is clean.
• Revalidated the added public references in the diff; all resolve through their source site or registry.

[cookesan]

Rechecked this reference-only PR while keeping the open Advisory Database queue current.

Adds direct commit and release references for GHSA-qc2x-6f54-m6h9. The advisory already references the upstream GHSA, issue #1752, PR #1756, and package source; this PR links the merged fix to the fixed zeroconf release.

Current audit, July 8, 2026:

• GHSA-qc2x-6f54-m6h9 is live and not withdrawn.
• NVD currently returns no record for CVE-2026-48487, so this PR does not add an NVD reference.
• Issue [GHSA-hm7p-r324-hhf3] phpseclib Infinite Loop vulnerability #1752 is closed, and PR [GHSA-mc23-976p-j42x] xterm vulnerable to remote code execution  #1756 merged to master as commit 544449596e645fcaad3834fa0cb614a54f847a82.
• Release 0.149.16 is published and not marked draft or prerelease.
• PyPI zeroconf 0.149.16 resolves and is not yanked.
• Local JSON validation and whitespace checks pass, and the diff only changes this advisory.

No advisory data fields are changed.