CVE-2026-69146: MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth

When MLflow is deployed with the built-in basic-auth plugin (--app-name basic-auth), any authenticated user can inject arbitrary dataset records into another user’s run by calling POST /api/2.0/mlflow/runs/log-inputs. The LogInputs proto handler is absent from the BEFORE_REQUEST_HANDLERS map in mlflow/server/auth/__init__.py, so the before-request hook skips authorization entirely and the request succeeds. Standard write endpoints on the same run – such as POST /api/2.0/mlflow/runs/log-metric – correctly return HTTP 403.