BotSharp agent framework has hardcoded JWT key, allowing admin token forgery

BotSharp 5.2.0 and earlier versions have an authentication bypass vulnerability. An unauthenticated remote attacker can exploit the hardcoded Jwt:Key in the WebStarter appsettings.json to forge a bearer token, impersonate any known user including an administrator, and access API routes protected by Authorize. The attacker can sign the token using the committed HMAC secret along with the fixed botsharp issuer and audience.