fix: [security] changed menu_custom_right_link to CLI only

- allows a malicious / hijacked admin account to embed malicious js in a global menu link otherwise
- as reported by Nils Putnins and Jeroen Pinoy from NCIA NCSC

app/Model/Server.php

@@ -6246,6 +6246,7 @@ class Server extends AppModel
                     'value' => null,
                     'type' => 'string',
                     'null' => true,
+                    'cli_only' => true,
                 ],
                 'menu_custom_right_link_html' => [
                     'level' => self::SETTING_OPTIONAL,