Add advisory for bip322

[raphjaph]

Affected crate(s)

• crate bip322 (https://crates.io/crates/bip322)

Links to upstream issue(s) or PR(s)

https://github.com/rust-bitcoin/bip322

Severity

Critical (9.1/10)

Any application treating successful verification as proof of address ownership
can be compromised. An unauthenticated attacker could impersonate any P2WPKH or
P2SH-P2WPKH wallet to authorize state-changing actions such as withdrawals,
borrowing, or wallet linking. Application-level nonces do not mitigate this,
since the attacker can construct and sign the current challenge message with
their own key.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate

[djc]

Thanks for reporting!