GHSA-rcmc-q9rj-4wmq: praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}

The `PATCH /workspaces/{id}` endpoint in praisonai-platform allows any workspace member to change the workspace's name, description, and settings (a free-form JSON configuration object) because it only checks that the user is a member, not that they have owner-level permissions. This is dangerous because attackers could inject malicious settings that could redirect API calls to attacker-controlled servers, disable logging, or change other critical configurations depending on what the platform reads from the settings field.