A flaw was found in CRI-O's container-creation environment-variable handling (`mergeEnvs` in `server/utils.go`, consumed by `setupContainerE

A flaw was found in CRI-O's container-creation environment-variable handling
(mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in
server/container_create.go). When a CreateContainer request supplies a nil CRI
Envs field, CRI-O falls back to using the target OCI image's config.Env entries
unfiltered, in contrast to the normal merge path, which validates each entry for a
key=value form before use. An OCI image whose config.Env contains an entry with no
= character (e.g. a bare NOEQUALS string) causes CRI-O to split that entry into a
single-element slice and then index its second element, which is out of range. This
triggers an unrecovered Go runtime panic in the crio daemon process, crashing it and
terminating the container-runtime service for all workloads on the node until it is
restarted.