Added details for version 5.1.8 and 4.3.9, including fixes for oversized bounds and performance improvements for hash-collision buckets. Updated CVE references for security advisories.

The trie root was stored as `null` in two places (small-List constructor
and the "origin within tail" branch of setListBounds), so a List grown
past 32 elements while all values are `undefined` read them back as
`null`. Normalize both to `undefined`, matching the rest of the file.

fix(List): preserve undefined values when grown past 32 elements