GHSA-9ccq-2jfg-qw33: Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match

Grav CMS has a security flaw in how it checks whether a web request's Referer header (the page the user came from) belongs to the same website. The code uses `str_starts_with()` to compare the Referer against the site's root URL, but without checking for a boundary character (like a slash) after the match. This allows an attacker to register a domain like `example.com.attacker.tld` that starts with the victim's domain name and bypass the origin validation check, potentially leading to unauthorized actions.