GHSA-5wg6-jmq2-53pw: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing

Coder's workspace app had a security flaw where CORS (cross-origin resource sharing, a browser security feature that controls which websites can access each other's data) checks could be bypassed by using a UUID (universally unique identifier, a standardized format for unique IDs) in a subdomain to trick the system into trusting an attacker's username. An authenticated attacker could craft a malicious URL that, if visited by a victim while logged in, would allow the attacker's code to steal data from the victim's workspace apps.