GHSA-ggw3-5987-rx77: Pomerium Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback

Pomerium's authentication callback endpoint allows unauthenticated attackers to send specially crafted encrypted messages that trigger unbounded decompression of zstd-compressed data (a compression algorithm), causing the proxy to allocate unlimited memory and crash. The vulnerability exists because the code decompresses attacker-controlled data before validating who sent it, and unlike other parts of Pomerium's code, it doesn't limit how much memory the decompression can use.