Add RUSTSEC advisory for git2

[BoLu1225]

Have confirmed with the maintainer and fixed the bug in latest release

[djc]

@ehuss do you agree that publishing an advisory for this is useful? Should it be informational = "unsound"?

[cuviper]

FYI we are discussing in the security response team whether this warrants a full CVE, but it didn't come to our attention until after the fact. I personally think at least informational = "unsound" is reasonable though, and I suppose we can update rustsec if we decide to go further.

[djc]

FYI we are discussing in the security response team whether this warrants a full CVE, but it didn't come to our attention until after the fact. I personally think at least informational = "unsound" is reasonable though, and I suppose we can update rustsec if we decide to go further.

Thanks. @BoLu1225 can you add the informational metadata?