GHSA-5c3f-6486-3g7g: Gogs's password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES

Gogs (a Git service) has a bug where password-reset tokens use the account-activation lifetime instead of the configured reset-password lifetime. The token's expiration time is baked into the token itself when it's created, so changing the reset-password timeout setting has no effect, and attackers who intercept a reset token can use it far longer than administrators intended.