Account takeover via unsanitized work item title fallback

Stored cross-site scripting in GitLab CE/EE 18.1 through 18.1.3 and 18.2 through 18.2.1 allows remote authenticated users to take over accounts. The Work Item title component passes a computed fallback to v-safe-html; when sanitization makes title_html empty, the fallback selects the original unsanitized title and renders attacker-supplied markup. Exploitation requires the Work Items beta feature flags, an authenticated attacker who creates a maliciously named item, and a victim who opens it and clicks the overlaid link.