bank-vaults vault-secrets-webhook

• CVE-2026-54725 Critical 9.6 vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API 0.4%