GHSA-m2h6-4xpq-qw3m: A Fleet team maintainer can transfer hosts from any team via missing source team authorization

Fleet's host transfer API has a broken access control vulnerability (a flaw where permission checks don't work properly) that lets a team maintainer steal hosts from other teams by transferring them without authorization checks. Once stolen, the attacker can control the devices and run scripts with root privileges (the highest permission level), breaking team isolation in multi-tenant deployments (systems serving multiple separate organizations).