Cross-meeting presentation deletion via unchecked presentationId

Authorization bypass in BigBlueButton before 3.0.29 allows remote authenticated users to delete another meeting's presentation via /api/graphql. In RemovePresentationPubMsgHdlr.scala, the delete flow trusted the caller-supplied presentationId and called PresPresentationDAO.delete without confirming that the target presentation belonged to the current meeting; the fix adds meetingId-scoped lookup and deletion. Presenter-level access is required, and successful exploitation disrupts another meeting's materials when a valid presentation identifier is known.