Add LPM Firewall credits to npm malware advisories

[tolgaergin]

Summary

Updates existing OpenSSF malicious-package advisories to include LPM Firewall as an additional finder and adds the corresponding public LPM report pages as references.

This follows maintainer guidance on the earlier duplicate/new-advisory PRs:

• Add malicious npm package react-next-vite #1354 -> merge into existing react-next-vite advisory
• Add malicious npm package na-rony-test-karem #1356 -> modify contributors on existing na-rony-test-karem advisory
• Add malicious npm package testudo-pack #1357 / Add malicious npm package testis-pack #1358 -> existing testudo-pack and testis-pack advisories were merged via Add OSV reports for 3 malicious npm packages #1363, with credits open to adjustment because the earlier reports were submitted first

Updated advisories

• react-next-vite: MAL-2026-10211
• na-rony-test-karem: MAL-2026-6966
• testudo-pack: MAL-2026-10075
• testis-pack: MAL-2026-10074

Validation

• Parsed all four modified JSON files successfully with Node.js JSON.parse.