GHSA-v54h-cp2w-9x4g: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps

The `coder open app` command (a tool that opens external applications linked to workspaces) was vulnerable to leaking session tokens (secret credentials that prove a user's identity) to attacker-controlled websites. When a workspace's external app URL contained a `$SESSION_TOKEN` placeholder, the command would replace it with the real token before opening the URL, potentially sending it to an attacker's server if they controlled the workspace's app definitions. This could allow an attacker to impersonate the user and access their account.