Correct patched versions for omniauth-oauth2

The CVE claims that versions through 1.1.1 are affected. Neither
announcement seems entirely complete but the CVE seems better since it
includes specific versions.