A cybersecurity researcher found millions of files exposed in a database tied to CitySourced, a civic engagement platform used by local governments.