fix(api): enforce public-only scope for compare heads (#39006) (#39013)

Backport #39006 by @bircni

Enforce public-only token scope for repositories resolved as compare
heads.

_Assisted-by: Codex:GPT-5_

Co-authored-by: bircni <bircni@icloud.com>

routers/api/v1/repo/pull.go

@@ -1099,6 +1099,10 @@ func parseCompareInfo(ctx *context.APIContext, compareParam string) (result *git
 		ctx.APIErrorInternal(err)
 		return nil, nil
 	}
+	if !ctx.TokenCanAccessRepo(headRepo) {
+		ctx.APIErrorNotFound()
+		return nil, nil
+	}
 
 	isSameRepo := baseRepo.ID == headRepo.ID