ash-project ash_lua

• CVE-2026-78216 Medium 6.0 AshLua eval read operations can read field-policy-protected fields via aggregates 0.4%
• CVE-2026-82586 High 8.2 AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes 0.5%