Authenticated account enumeration via meetings filter

Information disclosure in OpenProject before 17.3.2 allows remote authenticated users to enumerate accounts through meetings filters. The meetings handler accepts an invited_user_id in the filters GET parameter and returns distinguishable responses that expose valid users' full names. Any low-privileged authenticated account can probe sequential IDs over the network; the reported consequence is account existence and full-name disclosure only.