GHSA-3f62-qv96-4p78: @actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets

A bug in @actual-app/sync-server allows non-admin users to discover which admin-configured bank-sync secrets (credentials for integrations like bank connections) have been set up. The GET endpoint that retrieves secrets only checks that a user is logged in, while the POST endpoint that creates secrets properly requires admin access, creating a security gap where authenticated regular users can probe and learn which integrations exist without seeing the actual credential values.