chore: don't load settings twice for running web (#12111)

- It's quite hard to determine when and why this was added here, my best
  guess is that this being the "oldest" subcommand at some point loading
  the configuration was not unified. Now it is unified in
  `prepareWorkPathAndCustomConf` which is run before any subcommand is
  run. It determines the work path, custom path and (custom) config and
  then loads the settings by calling `LoadCommonSettings`.
- Between `prepareWorkPathAndCustomConf` being called and
  `serveInstalled` being called the `setting.CustomConf` is not changed.
  There was a possibility this being necessary for install page ->
  installed, but the install code already ensures that the new config is
  loaded and used.
- Thus calling to load the settings again here is not necessary. There's
  a small possibility some settings loading code was written to only work
  after being loaded the second time. That's a bug that needs to be fixed,
  because all other subcommands does not load the settings twice and would
  see a different view of the settings in that case. I don't fear such
  code being present here.
- Resolves forgejo/forgejo#11024

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12111
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>

modules/setting/setting.go

@@ -119,8 +119,8 @@ func loadCommonSettingsFrom(cfg ConfigProvider) error {
 
 	mustCurrentRunUserMatch(cfg) // it depends on the SSH config, only non-builtin SSH server requires this check
 
-	loadOAuth2From(cfg)
 	loadSecurityFrom(cfg)
+	loadOAuth2From(cfg)
 	if err := loadAttachmentFrom(cfg); err != nil {
 		return err
 	}