GHSA-953h-535j-jg2v: agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable

The MCP proxy’s client-facing session ID embeds the authenticated caller’s subject (JWT sub claim) specifically as an anti-hijacking discriminator — matching the Model Context Protocol specification’s documented session-hijacking guidance (https://modelcontextprotocol.io/specification/2025-06-18/basic/security_best_practices#session-hijacking). However, the session-resume path never checks that discriminator against the current caller’s identity, so any client that obtains a session ID (its own or another user’s) can resume that session and act with it — including on routes with per-user backend sessions. This is aggravated by the official Helm chart shipping a literal, publicly known default seed ("default-insecure-seed") for the key that encrypts these session IDs.