doc: vulnerabilities: Document public CVEs

Include documentation for CVE issues that are now out of embargo.  This
includes links to the CVE database, as well as referencing the PRs
within Zephyr that fix these issues.

Signed-off-by: David Brown <david.brown@linaro.org>