GHSA-mf8r-wm2w-f8c5: phpMyFAQ public FAQ APIs expose inactive FAQ content

The public FAQ API applies inconsistent active = 'yes' filtering across endpoints. A FAQ entry marked active = 'no' is hidden from GET /api/v3.1/faqs/{categoryId} in phpMyFAQ 4.1.4, but the same inactive FAQ can still be retrieved through public API routes:

• GET /api/v3.1/faq/{categoryId}/{faqId} returns the inactive FAQ title and full answer.
• GET /api/v3.1/faqs/tags/{tagId} returns the inactive FAQ title and answer preview.

On the current 4.2-style branch, api.onlyActiveFaqs=true hides inactive FAQs from list and direct-by-id endpoints, but GET /api/v4.0/faqs/tags/{tagId} still returns inactive FAQ title and preview because it calls Faq::getFaqsByIds() without active/date filtering.

Inactive FAQs are commonly used as drafts or review-only content, so these unauthenticated public API paths may disclose non-public content.