Checklist before requesting a review

Please delete options that are not relevant.

• I have performed a self-review of my code.
• I have added tests (when available) that prove my fix is effective or that my feature works.
• I have updated the CHANGELOG with a short functional description of the fix or new feature.
• This change requires a documentation update.

Description

• fixes #N/A
  Some ajax config endpoints only checked that the user was logged in, without verifying the config right, allowing any authenticated user to read or alter plugin field configuration.
  The default value field listing and the URL field type also echoed stored values without escaping, allowing a stored value to be rendered as active content.
  This change adds the missing right checks and escapes the affected outputs.

Screenshots (if appropriate):