Resolves issue #1868, hardens CVE ID modification against unauthenticated org short-name fallback.

[david-rocca]

Closes Issue #1868

Summary

This PR updates CVE ID modification so modifyCveId requires authenticated request context and no longer falls back to resolving req.ctx.org by short name when unauthenticated.

Important Changes

src/controller/cve-id.controller/cve-id.controller.js

• Added a fail-closed authentication guard in modifyCveId.
• Removed the unauthenticated findOneByShortName(req.ctx.org) fallback.

test/unit-tests/cve-id/cveIdUpdateTest.js

• Added regression coverage proving unauthenticated direct controller calls do not resolve org short names.
• Updated controller tests to model authenticated middleware context.

test/integration-tests/cve-id/cveIdUpdateTest.js

• Added route-level coverage that invalid auth is rejected before CVE ID update.