CVE-2026-104480: Discord's libdave accepts an MLS Welcome it should refuse

A missing roster check in libdave lets a signalling-path attacker add an unauthorised member to an end-to-end encrypted call.