Updating thanks to include XSS reporter

I also changed "are sponsoring" to "sponsored" for a thing that happened in the past.