feature: nodejs - CVE-2025-27210 - path traversal via device name on Windows


Add CVE‑2025‑27210 to the inventory.

An incomplete fix in Node.js allows attackers on Windows to exploit reserved device names like `CON`, `PRN`, and `AUX` when using `path.join()` or `path.normalize()`. This bypasses directory restrictions and enables access to arbitrary files.

**Section:** ctf/app/nodejs/  
**Type:** path traversal / information disclosure  

Windows only.
