Fix typo for CVE in 09 July release announcements

Link and text different by 1 digit. CVE from text is completely unrelated so changed to match link from curl website.

Added headers — they're needed here, but not in the XML for the 'archive'

Announce PHP 7.4.8