Authenticated secret disclosure via annotation-controlled rotation scope

Improper access control in Bitnami Sealed Secrets 0.35.0 allows remote authenticated users to recover plaintext Kubernetes secrets. The /v1/rotate handler unseals the submitted object, copies spec.template metadata onto the Secret, and lets SecretScope derive the new scope from attacker-controlled annotations. An attacker needs a victim SealedSecret and authenticated permission to call the rotation endpoint; setting the cluster-wide annotation removes name and namespace binding and exposes the recovered credentials.