Add AWS CDK NodejsFunction fix references

[cookesan]

Adds AWS CDK NodejsFunction fix references to GHSA-999r-qq7v-r334.

Audit refresh, July 8, 2026:

• Confirmed the live PR is open, ready for review, merge-clean, and the visible advisory check is green.
• Rechecked the merge-base diff: exactly one advisory JSON file changes (advisories/github-reviewed/2026/06/GHSA-999r-qq7v-r334/GHSA-999r-qq7v-r334.json), JSON parses, git diff --check passes, and the exact-head worktree is clean.
• Revalidated the added public references in the diff; all resolve through their source site or registry.

[cookesan]

Refreshed on July 8, 2026:

• GHSA-999r-qq7v-r334 and CVE-2026-11417 remain public and consistent with this advisory.
• Verified aws/aws-cdk PRs #37292 and #37412, commits 9bf4263ea631cae7c0cfff8872ec4fb3a3164cc1 and a92105c64c4ff30bd85f506ef4f7dec39a923871, releases v2.245.0 and v2.246.0, and npm aws-cdk-lib@2.246.0.
• Local validation passed: jq empty and git diff --check.

No affected range, package, or severity changes are included.