Add TinaCMS fixed source tag references

[cookesan]

Summary

• add the TinaCMS fixed source tag references for tinacms 3.9.3 and @tinacms/mdx 2.1.7
• keep the NVD advisory reference for CVE-2026-55661

Validation

• confirmed the advisory aliases CVE-2026-55661 and affects tinacms 3.9.3 and @tinacms/mdx 2.1.7 as fixed versions
• confirmed upstream PR [GHSA-gp2f-7wcm-5fhx] Craft CMS has Cloud Metadata SSRF Protection Bypass via DNS Rebinding #7056 is merged
• confirmed the tinacms@3.9.3 and @tinacms/mdx@2.1.7 source tag URLs return HTTP 200
• confirmed both fixed tags dereference to the same fixed source commit
• confirmed the tinacms@3.9.2...tinacms@3.9.3 and @tinacms/mdx@2.1.6...@tinacms/mdx@2.1.7 comparisons contain the merged security PR commit
• confirmed npm has tinacms 3.9.3 and @tinacms/mdx 2.1.7 package metadata with tarball integrity data
• confirmed NVD returns CVE-2026-55661 with status Deferred
• ran jq empty on the advisory JSON
• ran git diff --check