GHSA-6p9m-q3jp-47h4: Gogs: LFS dedupe path leaks private repo content across tenants

Gogs (a git hosting service) has a security flaw in its LFS (large file storage, a system for storing large files in git repositories) implementation where the deduplication shortcut skips hash verification, allowing any user with write access to one repository to claim ownership of LFS objects from private repositories they cannot access. An attacker can bind a file OID (object identifier, a unique hash) from a private repo to their own repo and download the private content through their own download endpoint.