fix: discard settings for external controller in profiles

[karin0]

Profiles can contain insecure settings for external controllers, and having a default value in ConfigurationOverride didn't help because they wouldn't be serialized (#299 (comment)). This PR disables the external controller in the original profile before the override is applied, so that only the explicit override settings are retained.

[karin0]

The main branch seems to have fixed it, but shall we clear ExternalControllerUnix and Secret to ensure all settings for external controller from the profile are cleared?

[wwqgtxx]

ExternalControllerUnix will be restricted by Android's file permission management and cannot be accessed by third-party applications on non-ROOT platforms, so it does not pose a security issue.
As for Secret, if you directly clear the configuration file, it may cause some people to forget to manually set the password in the GUI, so it is a relatively good practice to keep reading the configuration file.

[karin0]

Got it, thanks for the clarification!