REDHAT-BUG-2549646: Low severity Red Hat Quay vulnerability

A flaw was found in Red Hat Quay. The repository auto-prune policy endpoint (GET on /api/v1/repository/<namespace>/<repository>/autoprunepolicy/<policyuuid>) resolves the policy using the repository name and policy UUID only, without scoping to the authorized namespace. Because repository names are not globally unique (every namespace may have a repository with the same name), a user who is admin of a repository named X in their own namespace can read the auto-prune policy of a repository named X in another namespace by supplying that policy's UUID. The vulnerability is in data/model/autoprune.py in the getrepositoryautoprunepolicybyuuid function, which queries by Repository.name and UUID but never joins to the User table to enforce namespace scoping. The sibling function getrepositoryautoprunepoliciesbyreponame correctly scopes by namespace. The PUT and DELETE methods for the same resource are not affected because their model queries are namespace-scoped. Exploitation requires knowledge of the victim policy's random v4 UUID and a repository with a matching name. The leaked data is limited to low-sensitivity policy configuration (prune method, value, tag pattern).