Add Directus CORS fix commit reference

[cookesan]

Adds Directus CORS fix commit reference to GHSA-g27j-74fp-xfpr.

Audit refresh, July 8, 2026:

• Confirmed the live PR is open, ready for review, merge-clean, and the visible advisory check is green.
• Rechecked the merge-base diff: exactly one advisory JSON file changes (advisories/github-reviewed/2022/04/GHSA-g27j-74fp-xfpr/GHSA-g27j-74fp-xfpr.json), JSON parses, git diff --check passes, and the exact-head worktree is clean.
• Revalidated the added public references in the diff; all resolve through their source site or registry.

[cookesan]

Refreshed on July 8, 2026:

• GHSA-g27j-74fp-xfpr and CVE-2022-26969 remain public and consistent with this advisory.
• Verified directus/directus PR #12022, commit 826404bcbe769f9bcd526baec41e696237b78ebb, release v9.7.0, and npm directus@9.7.0.
• Local validation passed: jq empty and git diff --check.

No affected range, package, or severity changes are included.