Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

### Summary Hatchet version v0.86.26 and below is vulnerable to OAuth state CSRF (login CSRF / account fixation). The vulnerable code clears the session `oauth_state_<integration>` value to the empty string `""` after a successful OAuth callback rather than removing the key, and the subsequent state-equality check then accepts an empty `?state=` parameter on any later callback request — allowing an unauthenticated attacker to bind an already-authenticated victim's session cookie to an attacker-controlled OAuth identity (account takeover via login-CSRF). ### Impact Affected configurations: any deployment that has enabled at least one of `auth.google.enabled`, `auth.github.enabled`, or the Slack integration, and where the victim has completed at least one OAuth flow on that integration in the current session. Bug present on `main` HEAD and in every tagged release up to and including v0.86.26 (commit `243f41d9e1161e70d47dfc0a6509f1c4ddfc9c23`). Source Code Location: https://github.com/hatchet-dev/hatchet Affected Packages: - go:hatchet, affected < 0.91.1, patched in 0.91.1 CWEs: - CWE-287: Improper Authentication - CWE-352: Cross-Site Request Forgery (CSRF) - CWE-384: Session Fixation - CWE-1275: Sensitive Cookie with Improper SameSite Attribute CVSS: - Primary: score 7.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N - CVSS_V3: score 7.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N References: - https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-phg3-3g28-wq9v - https://github.com/hatchet-dev/hatchet/commit/f90464189ad642251e09412d0f99fde353036428 - https://github.com/advisories/GHSA-phg3-3g28-wq9v