GHSA-8r6w-3qq5-4p4r: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

Pterodactyl, a game server management platform, has a privilege escalation vulnerability where the Wings component (the server control software) improperly validates JWTs (JSON Web Tokens, which are digitally signed credentials that prove identity). A subuser can reuse a JWT token meant for a lower-privilege action like viewing a console or downloading files to upload arbitrary files to a server without having explicit file upload permissions.