Root privilege escalation via mixed-case policy names

Privilege escalation in OpenBao before 2.4.4 allows remote authenticated users to gain root permissions through identity group updates. The group update handler preserves mixed-case policy names during case-insensitive deduplication, so its literal root check misses variants such as Root. Exploitation requires a privileged operator in the root namespace with identity/groups access but no policy access; successful abuse grants root-equivalent control over stored secrets and system operations.