GHSA-f5mf-3r52-r83w: OpenClaw's Zalouser allowlist authorization matched mutable group names by default

OpenClaw’s Zalouser allowlist mode accepted mutable group names and normalized slugs as authorization matches instead of requiring stable group IDs. In deployments that used name-based channels.zalouser.groups entries together with permissive sender allowlists, a different group could be accepted by reusing the same display name as an allowlisted group.