Strip feed URL credentials from anonymous query.php output (#9246)

p/api/query.php serialized entries with mode 'freshrss', putting the full stored
feed URL (including any user:pass@ credentials) into origin.feedUrl for f=json and
f=greader, exposing them to anonymous recipients of a "Share by RSS" link.

Call Feed::url(includeCredentials: false) on this path to strip the credentials,
matching the logging and OPML export paths.

Refs GHSA-rpmm-h4hx-5p6p

app/Models/Entry.php

@@ -1273,7 +1273,7 @@ class FreshRSS_Entry extends Minz_Model {
 			if ($mode === 'compat') {
 				$item['origin']['title'] = escapeToUnicodeAlternative($feed->name(), true);
 			} elseif ($mode === 'freshrss') {
-				$item['origin']['feedUrl'] = htmlspecialchars_decode($feed->url());
+				$item['origin']['feedUrl'] = htmlspecialchars_decode($feed->url(includeCredentials: false));
 			}
 			if ($feed->priority() >= FreshRSS_Feed::PRIORITY_MAIN_STREAM) {
 				$item['categories'][] = 'user/-/state/org.freshrss/main';