Reactions leak for secure category topics and private messages

An attacker can call the `/discourse-reactions/posts/reactions.json` endpoint with a target username to retrieve that user's reactions. Because the original code lacked access-control filtering on the underlying topics, the response included reactions on private messages and topics in secure (read-restricted) categories even when the attacker had no permission to view those topics. This leaks sensitive information about which posts a user reacted to. [ref_id=1]

The vulnerability is in the `reactions_given` action of `app/controllers/discourse_reactions/custom_reactions_controller.rb`. The original query joined `ReactionUser` with `:reaction, :post` but did not filter based on topic visibility, allowing reactions on private messages and secure-category topics to be exposed to unauthorized users. The patch adds a `secure_reaction_users!` method that applies access-control checks on the topic's archetype and category read restrictions.

The patch modifies the `reactions_given` query to join through `post: :topic` and adds a `LEFT JOIN categories` so that topic-level and category-level permissions can be checked. The new `secure_reaction_users!` method filters out private messages unless the requesting user is a participant or admin, and filters out topics in read-restricted categories unless the user belongs to an authorized group. This ensures the endpoint only returns reactions that the requester is allowed to see. [ref_id=1]