GHSA-3cm4-ccvw-6xr6: SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*

GHSA-c8r8-95hg-mp34 added a centralized guard, util.IsForbiddenAbsPath(), specifically to block access to a small set of sensitive files: conf/conf.json (plaintext accessAuthCode/API token/cookie key), data/snippets/conf.json, the entire data/templates/ directory, and data/.siyuan/publishAccess.json (plaintext publish-mode passwords). It was applied to kernel/api/file.go and kernel/mcp/tools/file.go. Two other routes in the same server that serve arbitrary files by path, /history/*path and /repo/diff/*path, construct their target paths independently and were not updated to call this new guard. Since the repo/history snapshot system’s tracked root is data/ (confirmed by getSyncIgnoreLines(), whose ignore file lives at data/.siyuan/syncignore with entries relative to data/), both data/.siyuan/publishAccess.json and data/templates/* fall within the scope that can legitimately be captured in historical snapshots, meaning a prior version of either file can exist in util.HistoryDir/the repo-diff temp checkout even after the live file has been protected by the new guard. This is CWE-862 (Missing Authorization) applied to a very recently introduced protection mechanism.