rack rack-session

• CVE-2026-39324 Critical 9.3 Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization 0.3%
• CVE-2025-46336 Medium 4.2 Rack session gets restored after deletion 0.4%