Fix API Authentication Bypass

[DawoudIO]

Description & Issue number it closes

• Fix API Authentication Bypass in apis where a query param alows security check bypass.
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-v3p2-mx78-pxhc#event-489177

Screenshots (if appropriate)

http://localhost/api/persons/latest?bypass=api/public was returning the full API Payload and now it returns 401.

How to test the changes?

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

[Copilot]

Pull Request Overview

This PR fixes a critical security vulnerability where API authentication could be bypassed using query parameters. The issue was that the authentication check was performed on the entire URI (including query parameters) rather than just the path.

• Changed authentication middleware to check only the URI path instead of the full URI
• Prevents bypassing authentication by adding ?bypass=api/public as a query parameter

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}