Correct block_buffer affected range for GHSA-qwgh-2vcv-g2f7 - #10698

What this changes

For block_buffer (crates.io), affected[0].ranges[0].events[0].introduced moves from "0" to "0.11.0-pre". The "fixed": "0.12.1" event is unchanged, so this only narrows the lower bound.

Why

The advisory's impact depends on the cursor position living inside the block that caller-provided callbacks can reach: EagerBuffer keeps its cursor in the last byte of the internal block, and ReadBuffer keeps it in buffer[0]. Neither the inline cursor nor the ReadBuffer type exists in the 0.10.x line.

0.10.4 stores the cursor in a separate field (https://docs.rs/crate/block-buffer/0.10.4/source/src/lib.rs):

• pub struct BlockBuffer<BlockSize, Kind> { buffer: Block<BlockSize>, pos: u8, _pd: PhantomData<Kind> } (lines 55-64). set_pos_unchecked writes only self.pos (lines 236-240), and every call site derives the value internally.
• digest_blocks gives the callback an immutable &Block reference to the internal buffer (line 165) or block slices derived from the caller's input; pos is only updated after the callbacks return (line 175). digest_pad passes &self.buffer immutably and resets afterwards (lines 307-315). In set_data, process_blocks receives the caller's data blocks, not the internal cursor (line 271).
• A caught panic therefore leaves pos at its previous, valid value: no callback path can overwrite the cursor from input.

The separate pos field is also present in the 0.10.0-pre line (https://docs.rs/crate/block-buffer/0.10.0-pre/source/src/lib.rs).

The inline layout starts at 0.11.0-pre (published 2022-12-19):

• src/lib.rs: pub struct BlockBuffer<BS: BlockSizes, K: BufferKind> { buffer: Block<Self>, pos: K::Pos }, with Eager::Pos = () (https://docs.rs/crate/block-buffer/0.11.0-pre/source/src/lib.rs).
• src/sealed.rs: Eager::get_pos returns buf[buf.len() - 1] and Eager::set_pos writes buf[buf.len() - 1] (https://docs.rs/crate/block-buffer/0.11.0-pre/source/src/sealed.rs).
• src/read.rs: ReadBuffer documents "The first byte of the block is used as position." (https://docs.rs/crate/block-buffer/0.11.0-pre/source/src/read.rs).
• 0.11.0 (stable) keeps Eager::get_pos/Eager::set_pos on the last byte of the block (https://docs.rs/crate/block-buffer/0.11.0/source/src/sealed.rs), so 0.11.0 remains covered by this range.
• The fix (block-buffer: fix exception safety RustCrypto/utils#1487) adds a ResetGuard around the callback calls in BlockBuffer and ReadBuffer, and its changelog entry is "0.12.1 — Fixed: Exception safety bug".

So the affected mechanism first appears in 0.11.0-pre, and "introduced": "0" additionally flags 0.10.x and earlier, which have no inline cursor and no ReadBuffer.

Scope

Versions 0.11.0-pre through 0.12.0 remain affected. This PR does not claim that 0.10.x is free of unrelated issues; it only states that the cursor-corruption path described in this advisory cannot occur there because the cursor is not stored in the block.