GHSA-5wrp-cwcj-q835: opentelemetry-go's baggage parsing no longer caps raw header length | AI Sec Watch