Carrot disclosure: Forgejo

Since Fedora moved from Pagure to Forgejo , I finally had an incentive to take a good look at Forgejo 's security posture. The results aren't pretty to be honest: SSRF in a lot of places, no CSP/Trusted-Types, a bit of ghetto templating in javascript, cryptographic malpractices, overlooks in the …