avahi: Add commented-out knownVulnerabilities for CVE-2024-52615

It would be better if there was a way to mark those mitigated issues in
a way that can be machine-consumed, without causing the package to be
marked insecure.

In actuality, the `insecure` bit for this particular vulnerability would
dpeend on the daemon configuration. The package itself cannot depend on
the system configuration.

A warning could be added to the NixOS module when the mitigation is
disabled.

pkgs/by-name/av/avahi/package.nix

@@ -251,5 +251,10 @@ stdenv.mkDerivation rec {
       DNS") and DNS-SD (for "DNS-Based Service Discovery")
       protocols.
     '';
+
+    knownVulnerabilities = [
+      # NOTE: CVE-2024-52615 mitigated by the default NixOS configuration.
+      # "CVE-2024-52615: Avahi Wide-Area DNS Uses Constant Source Port"
+    ];
   };
 }