Add LiquidJS symlink root fix reference

[cookesan]

Adds the upstream release-contained fix commit for harttle/liquidjs#867 to GHSA-56p5-8mhr-2fph.

Evidence checked:

• PR [GHSA-c8cc-hj57-vm65] Jenkins Active Directory Plugin 2.25 and earlier does not... #867 merged as 529dd67 and updates filesystem containment to use realpath for root and candidate files.
• The patch adds async and sync containment paths plus symlink escape regression coverage.
• Release v10.25.3 cites [GHSA-c8cc-hj57-vm65] Jenkins Active Directory Plugin 2.25 and earlier does not... #867 and commit 529dd67.
• npm liquidjs@10.25.3 has gitHead 8f69a083, and the v10.25.2...v10.25.3 compare contains 529dd67.
• The 10.25.3 package archive includes the realpath containment code in dist/liquid.node.js.