Reject token access (RSS/OPML export, feed refresh) for disabled accounts (CWE-613) (#9336)

* auth: reject token access for disabled accounts (CWE-613)

Minz_Request::tokenIsOk() validated the per-user token but never checked that
the account is enabled, so a disabled user's token still authorised RSS/OPML
export and feed refresh (c=feed&a=actualize). Session-based access already
enforces `enabled` in FreshRSS_Auth::giveAccess(); apply the same check to
token validation. Re-enabling the account restores token access as expected,
so no token rotation is needed.

* Reduce comments

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>

lib/Minz/Request.php

@@ -599,7 +599,7 @@ class Minz_Request {
 			return false;
 		}
 		$conf = FreshRSS_UserConfiguration::getForUser($username);
-		if ($conf === null || !hash_equals($conf->token, $token_param)) {
+		if ($conf === null || !$conf->enabled || !hash_equals($conf->token, $token_param)) {
 			return false;
 		}
 		return true;