Add advisory for solid-pod-rs-server access-control bypasses

[jjohare]

Adds an advisory for solid-pod-rs-server (a Solid pod server, Rust port of JavaScriptSolidServer).

• Package: solid-pod-rs-server
• Affected: >= 0.4.0-alpha.2, <= 0.5.0-alpha.12 (verified against the published crates: 0.4.0-alpha.1 has neither the COPY nor the glob handler, 0.4.0-alpha.2 has both)
• Patched: >= 0.5.0-alpha.13. All affected versions are yanked on crates.io.
• Upstream advisory: GHSA-265w-77fm-mg3g (published), CVSS 3.1 8.1 (High)
• Category: privilege-escalation
• Maintainer of the crate is the author of this PR; the fix and release are public (CHANGELOG 0.5.0-alpha.13).

Summary: COPY and glob GET skipped read-access checks; server-managed state (anchor signing keys, payment ledger) was reachable as ordinary pod content under a public-read root; the MCP interface did not canonicalise paths or enforce the dotfile allowlist. Operators are advised to rotate trail keys and audit ledger balances.

RUSTSEC-0000-0000 is the placeholder id for the maintainers to assign. I could not run rustsec-admin lint locally; CI will.

🤖 Generated by Claude Code