Look up known GitHub Security Advisories (GHSA) for a package + ecosystem — the same {ecosystem, package} shape a Renovate merge request reports.