Update changelog with CVE number.

Author: michaelrsweet

CHANGES.md

@@ -13,7 +13,7 @@ Changes in CUPS v2.4.17 (YYYY-MM-DD)
   values.
 - CVE-2026-34979: The scheduler did not always allocate enough memory for a
   job's options string.
-- CVE-2026-NNNNN: The scheduler incorrectly allowed local certificates over the
+- CVE-2026-34990: The scheduler incorrectly allowed local certificates over the
   loopback interface.
 - The scheduler followed symbolic links when cleaning out its temporary
   directory (Issue #1448)