docs: add changelog entry for React/Next.js security update (CVE-2025-66478)

[devin-ai-integration]

Summary

Adds a changelog entry documenting the security update from fern-platform PR #5629, which patched CVE-2025-66478 (React Server Components vulnerability).

The changelog entry explains:

• The nature of the vulnerability (CVSS 10.0, RCE risk)
• The dependency updates made (Next.js 15.5.4→15.5.7, React 19.0.0→19.0.1)
• Impact on Fern users (no action required for hosted users, self-hosted should update)

Review & Testing Checklist for Human

• Verify the external links work correctly (Next.js security advisory, release notes)
• Confirm the version numbers match what was actually updated in fern-platform PR #5629
• Review the customer-facing messaging for tone and accuracy

Notes

• Link to Devin run: https://app.devin.ai/sessions/e58a74a852874a6c983e70af8cb588a5
• Requested by: Catherine Deskur (catherine@buildwithfern.com)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[github-actions]

🌿 Preview your docs: https://fern-preview-36ae882e-4a36-4e7f-8b00-8e2493255497.docs.buildwithfern.com/learn

[thesandlord]

@chdeskur imo we dont need to be this explicit in the exact versions we are using