meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token (CVE-2026-54547) | HOL Guard CVE