GHSA-pj5h-5q6c-3pfx: Payload external upload trust validation issue

Under certain external upload configurations, Payload could send authentication data to a destination that was not verified as trusted. If the affected request contained a valid session, this could expose that session to an unintended recipient. You are affected if: - You have enabled external URL-based upload retrieval, where authenticated requests can trigger it. ## Patches Payload now validates the destination before forwarding authentication data and reapplies that validation when a request changes destination. …