Remove duplicate GHSA-xc6g reference

[cookesan]

Removes the malformed duplicate sanitize-html commit reference from GHSA-xc6g-ggrc-qq4r while leaving the clean commit reference intact.

Audit refresh, July 8, 2026:

• Confirmed the advisory still retains the clean upstream issue and commit, GHSA, npm package, npm advisory, and NVD references.
• Confirmed the GHSA and NVD records for CVE-2017-16016 still resolve.
• Local checks passed: one advisory JSON file changed in the PR diff, JSON parses, git diff --check passes, and the worktree is clean.