Fixes land on master and ship in the next release; older releases are not patched.

Report privately, not in a public issue:

• GitHub: private vulnerability reporting (preferred)
• Email: thach@tinyusb.org

See the threat model for what is in scope.