Cross-meeting agenda injection via missing section validation

Authorization bypass in OpenProject before 17.0.2 allows remote authenticated users to move agenda items into other meetings. The drag-and-drop move handler accepts a target meeting-section identifier without verifying that the section belongs to the source meeting or its recurring-meeting backlog. Manage Agenda Items permission is required; the action grants no access to the target meeting but injects arbitrary agenda items that can mislead participants.