GitLab patched a maximum-severity flaw that lets unauthenticated attackers run code on self-managed servers. Experts say: Patch now.