Threats affecting pkg:github/dulwich

Dulwich versions before 1.2.20 have a commit object parsing vulnerability where the parsing logic resolves duplicate tree headers incorrectly compared to core git. This causes Poetry 2.5.1, which uses Dulwich by default, to potentially check out attacker-controlled code that differs from what reviewers and CI systems see, enabling unreviewed code execution during install or build.