CVE-2026-33376: fix auth proxy IPv6 allow-list bypass (use /128 mask for IPv6, not /32)
CVE-2026-33377: fix dashboard import privilege escalation (set default dashboard
permissions only for newly created dashboards, not when overwriting an existing one)