Add undici WebSocket fix references

[cookesan]

Adds undici WebSocket fix references to GHSA-38rv-x7px-6hhq.

Audit refresh, July 8, 2026:

• Confirmed the live PR is open, ready for review, merge-clean, and the visible advisory check is green.
• Rechecked the merge-base diff: exactly one advisory JSON file changes (advisories/github-reviewed/2026/06/GHSA-38rv-x7px-6hhq/GHSA-38rv-x7px-6hhq.json), JSON parses, git diff --check passes, and the exact-head worktree is clean.
• Revalidated the added public references and package-version evidence in the diff; all resolve through their source site or registry.

[cookesan]

Review note: this expands the undici advisory with a WebSocket fix commit, fixed release, and npm package-version reference, plus EOF newline normalization. Affected ranges, severity, and advisory metadata fields are unchanged. Commit b4c287b3821a723d8c0912986fd2d8945399728d resolves to the fragmented WebSocket payload limit fix, the v8.5.0 release URL returns 200, and npm confirms undici@8.5.0. The advisory JSON validates against the OSV schema.