security: high-severity fixes (api throttle, fillable, idor, path, rel)

- Add 60 req/min throttle to the public API group and a stricter 10 req/min
  throttle to POST /highscores.
- Replace mass-assigned $guarded=[] with explicit $fillable on User, Meetup,
  Course, Lecturer, and SelfHostedService. created_by stays out of the
  whitelist; the existing creating() hooks continue to populate it.
- Require authenticated user on Api/MeetupController::index instead of
  trusting the user_id query parameter (IDOR).
- Constrain the /img and /img-public route paths to a safe character set
  and reject any path containing ".." in ImageController.
- Add rel="noopener noreferrer" to every target="_blank" link on the meetup
  and course landing pages.

routes/api.php

@@ -11,7 +11,7 @@ use App\Models\User;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Route;
 
-Route::middleware([])
+Route::middleware(['throttle:60,1'])
     ->as('api.')
     ->group(function () {
         Route::resource('countries', CountryController::class);
@@ -22,7 +22,9 @@ Route::middleware([])
         Route::resource('cities', CityController::class);
         Route::resource('venues', VenueController::class);
         Route::get('highscores', [HighscoreController::class, 'index'])->name('highscores.index');
-        Route::post('highscores', [HighscoreController::class, 'store'])->name('highscores.store');
+        Route::post('highscores', [HighscoreController::class, 'store'])
+            ->middleware('throttle:10,1')
+            ->name('highscores.store');
         Route::get('nostrplebs', function () {
             return User::query()
                 ->select([