Document upstream source fix for GHSA-p3pr-8f3m-4qp8

[eprogressing]

The advisory describes an unguarded http.client.HTTPConnection call in WindowsPhoneNotify.send(), but does not link the upstream source change that removes the affected addon. Add a Source Fix note and an OSV FIX reference to that commit so readers can identify the remediation.

Public evidence:

• pyload/pyload@989a551d2ae0c00b0d2c7baf6d850180c9b46559 deletes src/pyload/plugins/addons/WindowsPhoneNotify.py, including the affected send() method.
• The pyload-ng 0.5.0b3.dev101 PyPI wheel still contains that file. Its contents match the file in the deletion commit's parent, a293f8c1c0c84bf80fd35ea444c00cb658c9c74b.
• Wheel SHA-256: 18679af3e247bfd4bf5f3af0d3cba0f359bfb78a4d6425ee5d739e4f169c6839, matching PyPI release metadata.

I have left the affected version range and the statement about no fixed published release unchanged. Although the upstream advisory names 0.5.0b3.dev102 as patched, PyPI metadata does not list that release as of 2026-10-11. This contribution identifies the available source fix without claiming that an unpublished version is installable.

Validation: current OSSF OSV JSON schema and format checks pass; git diff --check passes; only this advisory's details and references change. No runtime exploitation test was performed; the evidence is the public patch and comparison with the published wheel.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.