OpenMetadata's JWT Filter Matched Paths by Substring, and a Semicolon Reopened the Door

A substring path comparison in OpenMetadata's JWT filter let a semicolon rewrite an unauthenticated request into an authenticated one. How the bypass reaches SpEL evaluation, and how to test whether your filter still behaves.