GHSA-crmg-9m86-636r: lxd's non-recursive certificate listing bypasses per-object authorization and leaks all fingerprints

LXD (a container management system) has a bug in its certificate listing endpoint where non-recursive requests (regular listing) return all certificate fingerprints (unique identifiers) without checking if the user has permission to view them, while recursive requests correctly filter by permission. This means any authenticated user, even those with restricted access, can see every trusted identity in the system.