GHSA-p5w8-m249-4r4v: Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type

Flowise has a permission validation bug in its delete endpoint for chat flows. The endpoint checks if a user has either `chatflows:delete` or `agentflows:delete` permission (authorization levels that control who can delete different types of workflow configurations), but it doesn't verify that the permission matches the actual type of resource being deleted. This means someone with only `agentflows:delete` permission can delete a chatflow, and vice versa, breaking the intended access control separation between these two resource types.