Twig config improvements (#5923)

* deprecate direct kimai_config access, which was only used internally
* prevent access to system configs
* prevent access to most configs in sandbox environments

templates/macros/widgets.html.twig

@@ -122,7 +122,7 @@
 
 {% macro user_avatar(user, tooltip, class, badge) %}
     {% set avatar = null %}
-    {% if user.avatar is not empty and kimai_config.themeAllowAvatarUrls %}
+    {% if user.avatar is not empty and config('themeAllowAvatarUrls') %}
         {% set avatar = asset(user.avatar, 'avatars') %}
     {% endif %}
     {% if not user.enabled %}