GHSA-RJR3-43J3-4Q8G Kubeflow Pipelines API server lacks authorization for shared pipeline uploads

Summary In multi-user mode, the Kubeflow Pipelines API server's HTTP multipart upload endpoints POST /apis/v2beta1/pipelines/upload and POST /apis/v2beta1/pipelines/uploadversion perform no authorization when the target namespace is empty. The authorization helper canUploadVersionedPipeline retur...