GCVE-1-2026-20310 — MISP module settings expose redacted values and allow API modification of CLI-only settings

During reconstruction of module settings, MISP discarded the module-declared “redacted” and “cli_only” flags. As a result, an authenticated user with permission to view server settings could obtain sensitive module values through the API and modify settings intended to be changed only from the command line.