Private-data disclosure via unchecked comparison token scope

Authorization bypass in Gitea 1.27.2 and earlier allows remote authenticated users to read private commits and diffs via comparisons. The shared parseCompareInfo helper checks account permissions for the private head repository but omits token-scope authorization during comparisons and pull request creation through a public base repository. Exploitation requires a public-only token with read:repository scope whose owner can access the private repository; the bypass defeats the token restriction, not the account's repository permissions.