GHSA-pc2w-4mq8-32qw

### Summary A missing human-approval gate on the `create_dynatrace_notebook` tool allows a caller to create persistent tenant-visible documents containing arbitrary content (including embedded DQL that other users execute when opening the notebook) without operator consent. ### Details `dynatrace-mcp-server` registers six write tools: `send_slack_message`, `send_email`, `send_event`, `create_workflow_for_notification`, `make_workflow_public`, and `create_dynatrace_notebook`. Five of these call `requestHumanApproval()` before executing the side-effect, which elicits the operator's explicit consent through the MCP elicitation protocol. The CHANGELOG explicitly states these approval gates were added "to ensure user consent and prevent unintended actions." `create_dynatrace_notebook` does not call `requestHumanApproval()`. The tool was introduced in a separate release from the approval-gate retrofit and was left ungated. As a result, a caller can create persistent, tenant-visible Dynatrace notebooks containing arbitrary content with no operator confirmation. Notebooks can include embedded DQL queries that later execute under the permissions of any tenant user who opens them. The vulnerable code is in `src/index.ts`, lines 1563-1601: ```typescript tool( 'create_dynatrace_notebook', 'Create Dynatrace Notebook', 'Create a new notebook in the Dynatrace platform ...', { name: z.string().describe(/* ... */), description: z.string().optional().describe(/* ... */), content: z.array(z.object({ type: z.enum(['dql', 'markdown']), text: z.string(), })).describe(/* ... */), }, { readOnlyHint: false, }, async ({ name, content, description }) => { const dtClient = await createAuthenticatedHttpClient(allRequiredScopes); const data = await createDynatraceNotebook(dtClient, name, content, description); // No requestHumanApproval() call. // No destructiveHint annotation. // Scopes requested are allRequiredScopes (the