How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos