GHSA-wqxv-w64v-5wh6: Suspended Coder users retain access to AI Bridge LLM proxy endpoints

A security flaw in Coder's AI Bridge (a proxy for accessing LLM services) allowed suspended users to keep using their existing API keys (authentication tokens) because the system didn't check if an account was suspended, only if the key itself was valid. This meant a suspended user could continue making expensive AI requests until their token expired, which could be months later.