GHSA-m2m6-cff5-3w7c: RedwoodSDK has Same-site CSRF through lack of origin validation in its server actions

Server actions in rwsdk apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site can invoke a server action with the victim’s session cookie attached.