Add React Router CSRF fixed references

[cookesan]

Adds React Router CSRF fixed references to GHSA-84g9-w2xq-vcv6.

Audit refresh, July 8, 2026:

• Confirmed the live PR is open, ready for review, merge-clean, and the visible advisory check is green.
• Rechecked the merge-base diff: exactly one advisory JSON file changes (advisories/github-reviewed/2026/06/GHSA-84g9-w2xq-vcv6/GHSA-84g9-w2xq-vcv6.json), JSON parses, git diff --check passes, and the exact-head worktree is clean.
• Revalidated the added public references and package-version evidence in the diff; all resolve through their source site or registry.

[cookesan]

Review note: this expands GHSA-84g9-w2xq-vcv6 with the React Router merged fix PR, React Router 7.15.1 evidence, and Remix server-runtime 2.17.5 evidence. I checked the PR head JSON against the OSV schema, confirmed remix-run/react-router#15033 is merged at aabd30c8d17fe698a64e096c9ee357cf1c3588fb, confirmed the React Router and Remix release URLs resolve, confirmed the referenced Remix commit resolves, and confirmed npm has react-router@7.15.1 and @remix-run/server-runtime@2.17.5; the affected npm ranges, CVSS score, alias, and package metadata stay unchanged.