GHSA-3jhr-mxmx-38cx: Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashe

## Summary `system/config/security.yaml`'s Twig sandbox policy allow-lists `offsetget` and `offsetexists` for `Grav\Common\User\Interfaces\UserInterface`. The concrete `Grav\Common\User\DataUser\User` class does not filter which fields `offsetGet()` returns, so any sandboxed template with access to a `User` object can read `hashed_password`, `secret` (2FA seed), and `twofa_secret` directly, bypassing the redaction Grav's own code applies everywhere else. …