[GHSA-jhqm-m4j3-wqq2] Add finder credit (CVE-2026-79655)

[ByteHackr]

Adds a credits entry crediting Sandipan Roy (@ByteHackr) as FINDER for this advisory.

Public evidence supporting this credit:

• The CVE record published by the Red Hat CNA credits the discovery to Sandipan Roy (Red Hat) — https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/79xxx/CVE-2026-79655.json
• Red Hat Bugzilla #2523363 (CVE-2026-79655) was created by Sandipan Roy (Bugzilla REST API creator field)
• Upstream report: [cleaner] extract follows out-of-tree tar symlinks sosreport/sos#4460, with proposed fix in [cleaner] refuse out-of-tree tar members on extract sosreport/sos#4461 (still open — no fixed release exists yet)

Note on affected: intentionally left empty. sos is an OS-level package outside the supported ecosystems (the sos project on PyPI is an unrelated "Script of Scripts" project), and no fixed version exists upstream yet. The credits structure follows the OSV schema and repo convention (e.g. merged PR #7190).

Per CONTRIBUTING.md this PR touches exactly one advisory. Thanks!

[ByteHackr]

Thanks! Aside from the credit, would the curation team be able to consider this advisory for review (i.e., upgrade it from the NVD mirror entry to a reviewed advisory)? It affects a system/distro package (sos), so I understand ecosystem version-range mapping may be limited, but happy to help with any additional information (affected versions, fixed versions, references) that makes the review possible.