GHSA-h4v5-crx2-3cv4: SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers

SiYuan's `/api/system/getConf` API endpoint leaks three sensitive secrets to unauthenticated users: the session-cookie signing key (used to forge login sessions), the OS username embedded in a file path, and encrypted-notebook key material. These three fields are explicitly hidden by a separate configuration-export endpoint, but the blocklist-based masking (which names fields individually rather than using a default-deny approach) missed them, causing them to be returned to anyone who can reach the endpoint.