Percent-encoded API path bypasses shop API ownership filters, exposing and modifying other customers' data

More info at https://github.com/Sylius/Sylius/security/advisories/GHSA-cqw6-3fwg-cfv4...