Credential disclosure via redirected contact-point tests

Information disclosure in Grafana Alerting 8.0.0 through 12.3.0 allows remote authenticated users to extract integration credentials. The contact-point test path lets Contact Point Writers replace another user's webhook URL while reusing its redacted secure settings, then sends a test notification containing those secrets to the attacker-controlled endpoint. The fixed Contact Point Writer role or either documented alert-notification permission is required, and exposure is limited to credentials stored in contact points accessible to that user.