GHSA-889w-m37p-88m5: pyLoad: Api.set_user_permission never invalidates the target's session

An admin who revokes or downgrades a non-admin user’s permissions through pyLoad’s own documented /api/<func> RPC surface — e.g. POST /api/set_user_permission (or its legacy alias /api/setUserPermission) — updates the target’s database row but never invalidates that user’s existing Flask cookie session. The demoted user keeps their pre-revocation role/permission bits on every subsequent WebUI page load and every subsequent /api/<func> call made with that cookie, for up to the default session_lifetime of ~31 days, or until they voluntarily log out. No action by the demoted user is required beyond already being logged in at the time of revocation.