gitea-CVE-2026-28699alardiians/gitea-cve-2026-28699Lab + writeup for CVE-2026-28699: Gitea OAuth2 scope enforcement bypass via HTTP Basic authauthentication-authorizationctfeducation+51