EEF-CVE-2026-82740

Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs

## Summary Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested `{:array, {:array, type}}` attribute, letting invalid input pass validation. `Ash.Type.apply_constraints/3` (`lib/ash/type/type.ex`) handled the `{:array, {:array, type}}` case by mapping only the inner `{:array, type}` constraints over each element, so constraints declared on the outer array (such as `min_length`, `max_length`, and `nil_items?`) were never applied. An attacker could submit an outer list that violates those constraints (too many elements, or `nil` entries where disallowed) and have it accepted and persisted. The fix enforces the outer array constraints and adds explicit handling for `nil` and non-list inputs. This issue affects ash: from 2.16.1 before 3.32.2.