[GHSA] GHSA-fm3f-ch8h-qw8q (medium) — @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

GHSA-fm3f-ch8h-qw8q Severity: medium CVE: CVE-2026-81888

@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

### Summary

The built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This d