chore(security): publish the two advisories fixed in 0.8.0 #428

Why

Two security advisories were fixed in 0.8.0 (#227 and the WebAuthn challenge store) but never published. One is still a draft and the other was closed without publishing, so neither lists a patched version. Disclosing fixed vulnerabilities is part of being checkably secure, and adopters on old versions cannot tell they are affected.

What

• Set the patched version (0.8.0) on both advisories and publish them, requesting CVEs
• For the audit write advisory, state the posture that shipped: lockout has its own counter, a failed counter write is reported on /health/status rather than swallowed, and an unreadable count is treated as locked
• Check the Session 2 advisory box on FIDO Functional Certification #155

Done when

Both advisories are published with a patched version and are visible on the repository's Security tab.