Private playlist disclosure via unchecked RSS route

Missing authorization in Invidious before 2.20260626.0 allows remote attackers to read private playlists through the RSS feed endpoint. The rss_playlist handler in src/invidious/routes/feeds.cr fetches an Invidious-native playlist and serializes its title, owner email address, and videos into Atom XML without checking its privacy setting or matching the requester to the owner. Exploitation requires a known playlist ID but no authentication; cryptographically random IDs prevent practical guessing, limiting exposure to IDs obtained through prior sharing, logs, history, or leakage.