CVE-2026-100870: Administrator password-reset link is built from the request Host header, allowing reset-token theft

More info at https://github.com/Sylius/Sylius/security/advisories/GHSA-77w3-2367-7xvq...

Host header injection in the shop password reset e-mail link when the channel has no hostname

More info at https://github.com/Sylius/Sylius/security/advisories/GHSA-v78h-66q4-h9px...