Add Snipe-IT 2FA reset fix references

[cookesan]

Adds Snipe-IT 2FA reset fix references to GHSA-6x4j-8954-5hxm.

Audit refresh, July 8, 2026:

• Confirmed the live PR is open, ready for review, merge-clean, and the visible advisory check is green.
• Rechecked the merge-base diff: exactly one advisory JSON file changes (advisories/github-reviewed/2026/06/GHSA-6x4j-8954-5hxm/GHSA-6x4j-8954-5hxm.json), JSON parses, git diff --check passes, and the exact-head worktree is clean.
• Revalidated the added public references and package-version evidence in the diff; all resolve through their source site or registry.

[cookesan]

Review note: this expands GHSA-6x4j-8954-5hxm with the Snipe-IT 2FA reset fix commit, v8.5.0 release, and matching Packagist package evidence. I checked the PR head JSON against the OSV schema, confirmed commit 046ef82c6501be14df597f0bf5d0de2566c7d6bc resolves to the 2FA reset API endpoint gate change, confirmed the release URL resolves, and confirmed Packagist lists snipe/snipe-it v8.5.0; the affected range, CVSS score, alias, and package metadata stay unchanged.