Advisories for Cargo/Jj-Lib package

Jujutsu 0.28.0 and earlier rely on versions of gitoxide that use SHA-1 hash implementations without any collision detection, leaving them vulnerable to hash collision attacks.

Specially crafted Git repositories can cause jj to write files outside the clone.