GHSA-w2ch-4xgr-22ww: Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal

Deleting a task relation only requires write access on the base task. Unlike relation creation, it does not verify that the caller can read the other task. A user with write access to one project can therefore delete relations whose other end lives in a project they have no access to. Since the delete removes both the forward and inverse rows, the relation also disappears for the other project’s members.