Add OpenTelemetry Operator token fix references

[cookesan]

Adds OpenTelemetry Operator token fix references to GHSA-cxh2-4639-vmc5.

Audit refresh, July 8, 2026:

• Confirmed the live PR is open, ready for review, merge-clean, and the visible advisory check is green.
• Rechecked the merge-base diff: exactly one advisory JSON file changes (advisories/github-reviewed/2026/06/GHSA-cxh2-4639-vmc5/GHSA-cxh2-4639-vmc5.json), JSON parses, git diff --check passes, and the exact-head worktree is clean.
• Revalidated the added public references in the diff; all resolve through their source site or registry.

[cookesan]

Refreshed on July 8, 2026:

• GHSA-cxh2-4639-vmc5 remains public and maps to CVE-2026-47701.
• Verified open-telemetry/opentelemetry-operator PR [GHSA-6v67-2wr5-gvf4] QOS.CH logback-core Server-Side Request Forgery vulnerability #5104, commit 95a8c2a3dc64a762d3ab8eba8c903b5702a03a9c, release v0.152.0, and the Go module proxy record for github.com/open-telemetry/opentelemetry-operator v0.152.0.
• Checked NVD on July 8, 2026; no NVD record is currently published for CVE-2026-47701.
• Local validation passed: jq empty and git diff --check.

No affected range, package, or severity changes are included.