Data modification and disclosure via ignored role hints

Improper access control in the Imperative Web Server in Oracle Helidon 4.5.0 allows remote authenticated users to read and modify data via HTTP. Public fix evidence indicates that SecurityHttpFeature.authorize in Helidon's webserver security layer returned success for an already authenticated request before enforcing SecureHandler.authorize(...) role hints, so secure routes could skip per-route role checks. Exploitation requires a valid low-privileged account and reaches only handlers built with that secure-route pattern, limiting impact to the data and operations exposed by those routes.