GHSA-3P64-6GVH-82V5 MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth

Summary When MLflow is deployed with the built-in basic-auth plugin --app-name basic-auth, any authenticated user can inject arbitrary dataset records into another user's run by calling POST /api/2.0/mlflow/runs/log-inputs. The LogInputs proto handler is absent from the BEFOREREQUESTHANDLERS map ...