security: patch root for webgui CVE

https://root.cern/about/security/#2023-11-26-open-port-for-control-of-web-gui-allows-read-and-write-access-to-file-system

spack.sh

@@ -60,6 +60,8 @@ a65f13f79f617b6aa0b235aa5db612473b6d8c0e
 ed8ecc469e7b87842a876323878831e301f136a2
 4991a60eacb5df289383f755e40702b720ed0513
 c485709f625429a88a184a099373d76c9438f8e3
+81e73b4dd4ea0bf6c6947359d3cee9d4270df13d
+6f08daf67020289e6a5ed1df9783ac5b2919e477
 ---
 ## Ref: https://github.com/spack/spack/commit/[hash]
 ## [hash]: [description]