wlc may disclose API tokens to project-configured URLs

Impactwlc could send an unscoped API token to an unintended server when run inside a directory tree containing attacker-controlled project configuration.If .weblate, .weblate.ini, or weblate.ini defines an API url, and the user supplies a token with WLCKEY or --key without also pinning the URL, w...