[wasmtime] 2 published advisory(ies) affect vendored sources

[github-actions]

Published advisories against vendored upstream sources

Advisory	Summary	Affected
GHSA-jqpg-j7w6-42pr	Dynamic record lifting can allocate beyond the hostcall fuel limit	v0.2 wasmtime 48.0.1, v0.3 wasmtime 48.0.1
GHSA-m63x-6p34-q65x	call_ref and exception catch can drop some fuel accounting, leading to exponential fuel amplification	v0.2 wasmtime 48.0.1, v0.3 wasmtime 48.0.1

Supersedes #35.

Owner: unset (WASMTIME_REBASE_OWNER)

Each vendored repo is matched by its pinned upstream commit, and every crate
that comes out of one by its locked version. OSV knows nothing about the
features GenVM disables or the patches it carries, so a row is a finding to rule
on rather than a proven exposure.

Fixing one goes through the usual flow — a manager feature branch, an executor
mirror at pr/<line>/<feature> targeting <line>-dev, then the standing
release gate. Nothing here writes to a branch.

This issue is edited in place while it is open. Close it once you have ruled
on the findings above; it is never closed or reopened automatically, and a new
issue is filed only when an advisory outside this list appears.