x/vulndb: add reports/GO-2022-0274.yaml for CVE-2021-43784

The linked CVE and GHSA describe an integer overflow error
which is fixed in 1.0.3, but the Project Zero report also
describes an issue with NUL bytes in inputs that is not
fixed until 1.1.0. I've used the later version as the fix.

Fixes #274

Change-Id: I36cfc402db1e0d48da068f93c9d618cb88bbe22a
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/416335
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Tatiana Bradley <tatiana@golang.org>
Run-TryBot: Damien Neil <dneil@google.com>

reports/GO-2022-0274.yaml

@@ -0,0 +1,21 @@
+packages:
+  - module: github.com/opencontainers/runc
+    package: github.com/opencontainers/runc/libcontainer
+    symbols:
+      - Bytemsg.Serialize
+    versions:
+      - introduced: 1.0.1-0.20211012131345-9c444070ec7b
+        fixed: 1.1.0
+    vulnerable_at: 1.0.1-0.20211012131345-9c444070ec7b
+description: |
+    An attacker with partial control over the bind mount sources of a new
+    container can bypass namespace restrictions.
+cves:
+  - CVE-2021-43784
+ghsas:
+  - GHSA-v95c-p5hm-xq8f
+links:
+    commit: https://github.com/opencontainers/runc/commit/f50369af4b571e358f20b139eea52d612eb55eed
+    context:
+      - https://github.com/opencontainers/runc/commit/dde509df4e28cec33b3c99c6cda3d4fd5beafc77
+      - https://bugs.chromium.org/p/project-zero/issues/detail?id=2241