EEF-CVE-2026-82749

Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records

## Summary Incorrect Authorization vulnerability in ash-project ash widens a relationship's `parent(...)` scoping filter to match unintended records when the referenced parent field cannot be resolved. Loading a relationship whose filter references `parent(...)` resolves that expression against the parent record. `resolve_parent_in_filter/3` (`lib/ash/actions/read/relationships.ex`) resolved an unresolvable parent reference (for example when the referenced field was not selected on the source query) to `nil` rather than failing. A scoping predicate such as `org_id == parent(org_id)` then becomes an `IS NULL` match, and a guard like `is_nil(parent(org_id)) or org_id == parent(org_id)` activates its unrestricted branch, so the relationship returns records the scope was meant to exclude. The fix fails the read with an error when a `parent(...)` reference cannot be resolved, instead of defaulting to nil. This issue affects ash: from 3.13.2 before 3.32.2.