CVE-2026-58431: Gitea: Public-only API token restriction is not enforced on team API routes

Gitea’s /api/v1/teams/{id} API routes do not correctly enforce the public-only access token restriction.

A public-only token is intended to limit API access to public repositories and public organizations. However, several team API routes continue to return private team repository metadata and private team activity feed entries when called with a public-only token.