Add informational advisory for lru panic safety issue

[tooson9010-spec]

Add informational advisory for lru panic safety issue

This advisory documents a panic safety vulnerability in lru::LruCache::pop()
that can lead to use-after-free conditions when key Drop implementations panic.

• Issue affects all current versions of lru
• Vulnerability is triggerable from safe Rust code
• Marked as informational = "unsound"

[djc]

Did you report this issue upstream, and obtain approval from the maintainer(s) to publish an advisory?

[tooson9010-spec]

@djc
Thank you for the reply.
I contacted the maintainer via email 3 weeks ago but received no response.
After waiting for a reasonable period, I proceeded with this advisory submission.

[djc]

It looks like they did patch another potentially security-sensitive issue 2 weeks ago. Would suggest opening an issue against their repository.