Clarify Grafana CVE-2024-9264 version handling

CVE-2024-9264 is a command injection and local file inclusion flaw (CWE-94/CWE-77) in the experimental SQL Expressions feature of Grafana, in which user-supplied input passed into duckdb queries is insufficiently sanitized. Any authenticated user with VIEWER or higher permissions can trigger it by submitting a crafted SQL expression, and the attack only works when the duckdb binary is present in the Grafana server's $PATH, which is not the case in default Grafana distributions. Successful exploitation allows the attacker to execute arbitrary operating-system commands as the Grafana process and read arbitrary local files on the server, potentially exposing configuration data and data-source credentials. Only Grafana deployments that use the SQL Expressions experimental feature and have duckdb installed on the host are exploitable, although the vulnerable code path is present in the product's standard builds. There is currently no public proof-of-concept and the flaw is not listed in CISA KEV, but its EPSS score of 94.9% (100th percentile) indicates a very high probability of exploitation within 30 days.