Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth

The Dragonfly Manager exposes GET /api/v1/oauth and GET /api/v1/oauth/:id to unauthenticated clients. The response body deserializes the entire manager/models.Oauth struct, which includes the clientsecret field. Any network-reachable attacker can read the OAuth client secrets configured for githu...