Add advisory for unsoundness in keccak ARMv8 backend (#2649)

See also: RustCrypto/sponges#101

Closes #2648

Author: tarcieri

crates/keccak/RUSTSEC-0000-0000.md

@@ -0,0 +1,32 @@
+```toml
+[advisory]
+id = "RUSTSEC-0000-0000"
+package = "keccak"
+date = "2026-02-12"
+url = "https://github.com/RustCrypto/sponges/pull/101"
+informational = "unsound"
+categories = ["crypto-failure"]
+aliases = []
+license = "CC0-1.0"
+
+[versions]
+patched = [">= 0.1.6"]
+```
+
+# Unsoundness in opt-in ARMv8 assembly backend for `keccak`
+
+### Summary
+
+The `asm!` block enabled by the off-by-default `asm` feature, when enabled on ARMv8 targets, misspecified the operand
+type for all of its operands, using `in` for pointers and values which were subsequently mutated by operations performed
+within the assembly block.
+
+### Impact
+
+It's unclear what practical impact, if any, this actually had. Incorrect operand types are technically undefined
+behavior, however changing them had no actual impact on the generated assembly for these targets. The possibility still
+exists that it may lead to potential memory safety or other issues on hypothetical future versions of rustc.
+
+### Mitigation
+
+The operand types were changed from `in` to `inout`, and the impacted versions of the `keccak` crate were yanked.