Authenticated tracker-name disclosure via unchecked parent serialization

Incorrect authorization in Enalean Tuleap allows remote authenticated users to read restricted parent tracker names through the REST API. GET /api/trackers/{child_id} serializes the parent tracker's name and color without first enforcing the caller's read permission on that parent. Exploitation requires access to a child tracker whose parent is otherwise inaccessible, and disclosure is limited to the parent's name and color.