GHSA-65w6-pf7x-5g85: @delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections

The @delmaredigital/payload-puc plugin had a critical authorization flaw where its `/api/puck/*` endpoints (handlers that create, read, update, and delete data) bypassed access control checks, allowing anyone without authentication to read, modify, create, or delete documents in registered collections like website pages. The vulnerability affected only collections explicitly registered with the plugin, not other Payload data collections like users or media.