cwe-78

Harbor PR #236 blocks CWE-78 in remote profile downloads

Harbor accepted remotely downloaded profile values that could later be expanded through eval, allowing command injection through a configuration import path. PR #236 adds validation before remote profiles are installed.