GHSA-9phw-7h96-q3rv: scheb/two-factor-bundle bypass two-factor authentication with remember-me option

The vulnerability arises from the absence of the RememberMeServicesDecorator in the bundle's code prior to the patch. This decorator prevents the remember-me cookie from being set during the initial authentication step when two-factor authentication is required. In vulnerable versions, the Symfony's default remember-me service implementation (not part of the bundle) would set the cookie immediately after the first authentication step, allowing bypass before 2FA completion. The bundle's code didn't contain vulnerable functions per se, but lacked the necessary decorator to properly intercept and delay cookie creation. The core vulnerability stems from missing safeguards in the integration layer rather than specific vulnerable functions in the bundle's code.