googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken) (CVE-2026-11717) | HOL Guard CVE