Add upstream fix reference for GHSA-xjw9-38cr-6372

[Michael-WhiteCapData]

Adds the exact upstream security-fix commit to GHSA-xjw9-38cr-6372. The record already identifies djust 1.1.2 as the first patched release but currently links only the release.

Evidence:

• The upstream v1.1.2 release identifies PR [GHSA-mvr2-9pj6-7w5j] Denial of Service in Google Guava #2444 as the security fix for this advisory: https://github.com/djust-org/djust/releases/tag/v1.1.2
• Comparing v1.1.1 with v1.1.2 shows commit 5288e5dbc8d83d8aee8a22a0a7a3a478461c8965 as the security change, with a commit message that documents the same template-binding safety-grant XSS described by this GHSA: djust-org/djust@v1.1.1...v1.1.2
• The commit was merged through upstream PR [GHSA-mvr2-9pj6-7w5j] Denial of Service in Google Guava #2444, which the release notes list under security changes: security(templates): a bind REPLACES the safety grant, it does not inherit one (1.1.2) djust-org/djust#2444

This adds one FIX reference and refreshes modified. Affected versions, severity, description, and all other metadata remain unchanged. I validated JSON parsing, whitespace, the release comparison, and the absence of an existing advisory-improvement PR for this GHSA.

AI-assisted metadata curation based entirely on already-public upstream history. No new vulnerability or exploit reproduction is claimed.