CVE-2025-32378: Shopware default newsletter opt-in settings allow for mass sign-up abuse

The vulnerability allows mass unsolicited newsletter sign-ups due to default double-opt-in (DOI) settings. The provided patch (commit 9786aaddd452ec54cb5a05c7abf71b24d7229d6f) modifies NewsletterSubscribeRoute.php. The core of the fix lies in changing the logic of the isNewsletterDoi method to correctly evaluate DOI requirements, especially for registered customers subscribing with an email different from their account email when 'doubleOptInRegistered' is disabled but general 'doubleOptIn' is enabled. The subscribe method, which is the main entry point for subscriptions, and getOptionSelection, which determines the initial subscription status, were both updated to use this corrected isNewsletterDoi logic. Therefore, the pre-patch versions of these three methods (subscribe, isNewsletterDoi, and getOptionSelection) are identified as the key functions involved in the vulnerability, as their original logic led to the bypass of the DOI mechanism under the described default settings.