GHSA-r2vg-hvjm-fg38 Shopware Customer Orders can be canceled, even if refunds are disabled

• Packagist shopware/platform: >= 6.7.0.0, < 6.7.3.1 → fixed in 6.7.3.1 • Packagist shopware/platform: < 6.6.10.7 → fixed in 6.6.10.7 • Packagist shopware/core: >= 6.7.0.0, < 6.7.3.1 → fixed in 6.7.3.1 • Packagist shopware/core: < 6.6.10.7 → fixed in 6.6.10.7

Refunds in general can be enabled through the administration setting `core.cart.enableOrderRefunds` (in the cart panel).Which visually shows and hides the button. However, using a custom crafted request, a customer can still cancel his own orders.As this is not checked inside the route (and also not in the controller): https://github.com/shopware/shopware/blob/trunk/src/Storefront/Controller/AccountOrderController.php#L98 https://github.com/shopware/shopware/blob/trunk/src/Core/Checkout/Order/SalesChannel/CancelOrderRoute.php To mitigate this, a check should be added to the `CancelOrderRoute` which verifies that the feature is enabled.