Security: Sanitize widget api keys from response

Closes https://github.com/gethomepage/homepage/security/advisories/GHSA-cjgf-vhj6-8cx4

src/pages/api/widgets/openweathermap.js

@@ -1,9 +1,11 @@
 import cachedFetch from "utils/proxy/cached-fetch";
 import { getSettings } from "utils/config/config";
+import { getPrivateWidgetOptions } from "utils/config/widget-helpers";
 
 export default async function handler(req, res) {
-  const { latitude, longitude, units, provider, cache, lang } = req.query;
-  let { apiKey } = req.query;
+  const { latitude, longitude, units, provider, cache, lang, index } = req.query;
+  const privateWidgetOptions = await getPrivateWidgetOptions("openweathermap", index);
+  let { apiKey } = privateWidgetOptions;
 
   if (!apiKey && !provider) {
     return res.status(400).json({ error: "Missing API key or provider" });