feat: add GHSA-9qr9-h5gf-34mp for Next.js RCE vulnerability

[knqyf263]

Summary

• Add vulnerability data for GHSA-9qr9-h5gf-34mp (Next.js RCE in React flight protocol)
• Use CVE-2025-55182 as the alias instead of CVE-2025-66478 which was rejected by CNA
• This enables proper vulnerability detection for affected Next.js versions

Related Issue

Closes aquasecurity/trivy-db#597

Test plan

• Validated with osv-linter (v1.6.7)

[DmitriyLewen]

Trivy correctly detects this vulnerability:

├────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼────────────────────────────────────────────────────────┼───────────────────────────────────────────────────────────┤
│ next               │ GHSA-9qr9-h5gf-34mp │ CRITICAL │        │ 16.0.0            │ 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7 │ Next.js is vulnerable to RCE in React flight protocol     │
│                    │                     │          │        │                   │                                                        │ https://github.com/advisories/GHSA-9qr9-h5gf-34mp         │
└────────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴────────────────────────────────────────────────────────┴───────────────────────────────────────────────────────────┘