GHSA-fcrw-f7gg-6g9f: Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users

The /api/users/metadata and /api/users/metadata/:id endpoints in @budibase/server return full global user profiles to any user with POWER role or above. For SSO-authenticated users (OIDC, Google), the response includes oauth2.accessToken and oauth2.refreshToken fields, leaking identity provider credentials to other users who should not have access to them.