[CVE-2020-16250] Unexpected security footguns in Go's parsers

Unexpected behaviors in Go's JSON, XML, and YAML parsers let attackers bypass authentication, evade authorization, and exfiltrate data—seen in HashiCorp Vault's CVE-2020-16250 and real engagements.