Security advisory: Skipper OPA body-authz bypass on chunked/HTTP-2

The GitHub Security Advisory database has published a high-severity issue affecting the Skipper project. The advisory, GHSA-5gpm-rgj3-9q76, describes a bypass in the OPA body authorization mechanism when handling chunked or HTTP/2 requests. Specifically, the mitigation for truncated bodies fails open due to the absence of a `content-length` header in chunked or HTTP/2 requests. Skipper truncates the body to `maxBodyBytes`, but the truncated_body flag remains false, allowing oversized payloads to pass through and reach upstream services. This issue is related to an incomplete fix for a prior advisory, GHSA-8qqm-fp2q-v734.

Operators should carefully evaluate their use of the `opaAuthorizeRequestWithBody` filter, especially in environments where chunked or HTTP/2 requests are common. Before upgrading or applying mitigations, it is crucial to test whether policies relying on body size checks are functioning correctly under these conditions. Additionally, operators should review their upstream services' ability to handle oversized payloads safely, as this bypass could expose them to unexpected input sizes.