fix: only reject addvote for users with running proposals

This was incorrectly indiscriminately targetting _any_ proposal
for a particular user.

Signed-off-by: Kevin Morris <kevr@0cost.org>

aurweb/routers/trusted_user.py

@@ -274,8 +274,10 @@ async def trusted_user_addvote_post(request: Request,
             context["error"] = "Username does not exist."
             return render_addvote(context, HTTPStatus.NOT_FOUND)
 
+        utcnow = time.utcnow()
         voteinfo = db.query(models.TUVoteInfo).filter(
-            models.TUVoteInfo.User == user).count()
+            and_(models.TUVoteInfo.User == user,
+                 models.TUVoteInfo.End > utcnow)).count()
         if voteinfo:
             _ = l10n.get_translator_for_request(request)
             context["error"] = _(