chore: strip advisory IDs from code comments and changelog (#4720)

Per the project's policy of treating security advisory IDs as
secret-like, remove the identifiers embedded in source/test comments
and CHANGELOG entries. Each keeps its human-readable description (and
PR number where present), so traceability is preserved. No logic changes.

tests/Controllers/ReportsControllerTest.php

@@ -10,7 +10,7 @@ use App\Models\Employee;
 use Config\OSPOS;
 
 /**
- * Regression tests for GHSA-9gr6-4mm4-4wrq
+ * Regression tests for the reports permission bypass
  *
  * Reports::__construct() previously derived the report method name from
  * $request->getUri()->getSegment(2), which CodeIgniter decodes once, while