bugfix:308 | remove ungated overrideConfig spread (#6279)

* fix(server): remove ungated overrideConfig spread into flowConfig/flowData

The spread allowed API callers to inject arbitrary keys into the $flow.*
template namespace — bypassing the per-parameter gating that
replaceInputsWithConfig() enforces. Properly gated override paths
(replaceInputsWithConfig, $vars) are unaffected.

Closes FLOWISE-308

* added chatflowId and apiMessageId into flowData in buildFlow