GHSA-q4w7-56hr-83rm: Nginx-UI Settings API Exposes Protected Secrets

Nginx-UI's GetSettings API endpoint returns all configuration settings to authenticated users, including 40+ sensitive fields marked as protected (like JwtSecret for forging auth tokens, NodeSecret for impersonating cluster nodes, and OIDC ClientSecret for OAuth takeover). The protection mechanism only works when saving settings, not when reading them, because the custom `protected:"true"` tag is ignored by Go's JSON serialization.