GHSA-3hc7-r24j-rpwc: Vikunja: Cross-project task disclosure through subtask expansion

Vikunja lets a task in one project have a subtask that lives in a different project. When listing a project’s tasks, an option pulls in those subtasks (?expand%5B%5D=subtasks). The main listing is correctly filtered to the projects the caller can access, but the subtask expansion is not: it returns the linked subtasks regardless of whether the caller has any access to the project they belong to. So a member with read-only access to one project can read the full content of tasks in other, private projects, any task that is a (recursive) subtask of a task the member is allowed to see.