Arbitrary file replacement via SSH key symlink

Incorrect authorization in ansible-core allows local users to replace arbitrary files and take ownership through the user module. The ssh_key_gen path follows a pre-existing symbolic link at the generated public-key filename, letting privileged ssh-keygen, chown, and chmod operations act on the link target. Exploitation requires an unprivileged account, traversal access to the target directory, and a privileged user to run the module with the disabled-by-default generate_ssh_key option.