Add CVE rules for Jan and Open WebUI components

[NY1024]

Summary
Added CVE security rules for components in the project that had fingerprints but lacked corresponding vulnerability rules; includes both Chinese and English versions.

Changes
Jan (1 entry)

CVE-2024-36858: Arbitrary file upload leading to RCE (CVSS 9.8 CRITICAL)
Open WebUI (3 entries)

CVE-2025-46719: Stored XSS allowing session token theft (CVSS 5.4 MEDIUM)
CVE-2026-45346: SVG renderer Stored XSS (CVSS 5.4 MEDIUM)
CVE-2026-54014: Cache path traversal allowing arbitrary file reading (CVSS 4.3 MEDIUM)
Details
All CVEs have been verified against the official NVD database; sources are authentic and reliable.
In accordance with project conventions, each rule is provided in both Chinese (data/vuln/) and English (data/vuln_en/) versions.

References
https://nvd.nist.gov/vuln/detail/CVE-2024-36858
https://nvd.nist.gov/vuln/detail/CVE-2025-46719
https://nvd.nist.gov/vuln/detail/CVE-2026-45346
https://nvd.nist.gov/vuln/detail/CVE-2026-54014

[boy-hack]

Code Review: Add CVE rules for Jan and Open WebUI components

✅ Strengths

• Covers both CN and EN versions for all 4 CVEs — bilingual parity maintained
• Open WebUI CVEs are well-documented with CVSS scores
• Rule format is correct

⚠️ Critical: Duplicate with PR #457

data/vuln/jan/CVE-2024-36858.yaml and data/vuln_en/jan/CVE-2024-36858.yaml are also being added by PR #457 with slightly different content.

Whichever merges second will cause a merge conflict. Please coordinate with @NY1024 (author of PR #457) to avoid the duplicate:

• Option A: Remove the Jan files from this PR (let PR feat: add CVE rules #457 handle Jan CVEs)
• Option B: Remove Jan files from PR feat: add CVE rules #457 and keep them here (with the more complete description in this PR)

Review Notes (Open WebUI rules)

• CVE-2025-46719 (Stored XSS, CVSS 5.4 MEDIUM): ✅ Correct severity
• CVE-2026-45346 (SVG renderer Stored XSS, CVSS 5.4 MEDIUM): ✅ Consistent
• CVE-2026-54014 (Cache path traversal): Confirm version range — ensure the rule: version ceiling matches the upstream fix.

🟡 Verdict

LGTM for Open WebUI rules. Resolve the Jan duplicate before merge.

[NY1024]

Thanks for the review! All feedback has been addressed:

1. Jan duplicate issue: Went with Option A — removed Jan files from this PR, letting PR feat: add CVE rules #457 handle them. Also fixed the version range in PR feat: add CVE rules #457 from version <= "0.4.12" to version > "0" && version < "0.5.2" (the original range would miss affected versions 0.4.13–0.5.1), and added the GHSA advisory reference.

2. CVE-2026-54014 version range: Confirmed version < "0.9.6" matches the upstream fix version. The range is correct.

3. Open WebUI rules: No changes needed, as confirmed.

Please re-review when you get a chance. Thanks!