Body validation bypass via Content-Type parser mismatch

Validation bypass in Fastify before 5.7.2 allows remote attackers to evade Content-Type-specific request body schemas. The validation selector splits Content-Type only on spaces or semicolons, while the body parser also accepts a tab delimiter, so a tab-suffixed media type is parsed but misses its schema. Exposure requires a route using schema.body.content; the unvalidated body reaches its handler, with downstream impact determined by the handler's trust in validated fields.