GHSA-h656-5vcf-cm23: OpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access Check

In Telegram DM mode, inbound media was downloaded and written to disk before sender authorization checks completed. An unauthorized sender could trigger inbound media download/write activity (including media groups) even when DM access should be denied.