Add advisory: finalfusion unbounded allocations (CWE-770)

[li-jin-quan]

Adds crates/finalfusion/RUSTSEC-0000-0000.md.

Quick timeline:

• Sep 4: opened fix PR finalfusion/finalfusion-rust#203 (grow buffers from bytes actually read, with regression tests).
• Sep 24: filed public disclosure issue finalfusion/finalfusion-rust#204 (unbounded allocations, CWE-770).
• Today is Oct 9. That is 15 days after public disclosure and 35 days after the fix PR, with zero responses so far.

Why an advisory now:

• The repo has had no commits since Oct 2023, and crates.io still shows 0.18.0 (Oct 2023) as the latest release.
• The last maintainer activity on the issue tracker was Aug 2024.
• So the authors look unreachable, and the fix has nowhere to land. patched = [] for now.

This follows the "no response two weeks after public disclosure" precedent in CONTRIBUTING. If the maintainers come back, happy to see this superseded by a patched release.

[djc]

Have reached out to the maintainers privately by email.