GHSA-h86g-x8mm-78m5

### Summary
It is possible to bypass the default REST API security and access the index page.

### Details
The REST API security handles `rest` and its subpaths but not `rest` with an extension (e.g., `rest.html`).

### Impact
The REST API index can disclose whether certain extensions are installed.

### Workaround
In `${GEOSERVER_DATA_DIR}/security/config.xml`, change the paths for the `rest` filter to `/rest.*,/rest/**` and change the paths for the `gwc` filter to `/gwc/rest.*,/gwc/rest/**` and restart GeoServer.

### References
https://osgeo-org.atlassian.net/browse/GEOS-11664
https://osgeo-org.atlassian.net/browse/GEOS-11776
https://github.com/geoserver/geoserver/pull/8170